Attachment 54537 Details for Bug 43906 – Partial fix

[patch] Partial fix

fix-overflows.patch (text/plain), 4.90 KB, created by Søren Sandmann Pedersen on 2011-12-18 07:06:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Søren Sandmann Pedersen

Created: 2011-12-18 07:06:26 UTC

Size: 4.90 KB

patch

obsolete

>From 96e18bc989ed73976804e8bc8dac586631db48f0 Mon Sep 17 00:00:00 2001
>From: =?utf-8?q?S=C3=B8ren=20Sandmann=20Pedersen?= <ssp@redhat.com>
>Date: Sun, 18 Dec 2011 07:29:59 -0500
>Subject: [PATCH] gradient-walker: For NONE repeats, when x < 0 or x > 1, set both colors to 0
>
>ec7c9c2b6865b48b8bd14e4 introduced a bug where NONE gradients would be
>misrendered, causing the area outside the gradient to be treated as a
>long fade to transparent.The problem was that a check for positions
>outside the gradients were dropped in favor of relying on the
>sentinels.
>
>Aside from misrendering, this also caused a signed integer overflow
>when the code would compute a stepper size based on MIN_INT32.
>
>This patches fixes the issue by reinstating a check for these cases
>and setting both the right and left colors to transparent black.
>---
> pixman/pixman-gradient-walker.c |    7 +++++++
> 1 files changed, 7 insertions(+), 0 deletions(-)
>
>diff --git a/pixman/pixman-gradient-walker.c b/pixman/pixman-gradient-walker.c
>index 048039e..e7e724f 100644
>--- a/pixman/pixman-gradient-walker.c
>+++ b/pixman/pixman-gradient-walker.c
>@@ -108,6 +108,13 @@ gradient_walker_reset (pixman_gradient_walker_t *walker,
> 	left_x  += (pos - x);
> 	right_x += (pos - x);
>     }
>+    else if (walker->repeat == PIXMAN_REPEAT_NONE)
>+    {
>+	if (n == 0)
>+	    right_c = left_c;
>+	else if (n == count)
>+	    left_c = right_c;
>+    }
> 
>     walker->left_x   = left_x;
>     walker->right_x  = right_x;
>-- 
>1.6.0.6
>
>From 6bce76492b7fd00d95f6afd69b08fd25cceb281e Mon Sep 17 00:00:00 2001
>From: =?utf-8?q?S=C3=B8ren=20Sandmann=20Pedersen?= <ssp@redhat.com>
>Date: Sun, 18 Dec 2011 08:16:45 -0500
>Subject: [PATCH] Fix some signed overflow bugs
>
>In the macros for the PDF blend modes, two comp1_t variables are
>multiplied together and then used as if the result was a comp4_t. When
>comp1_t is a uint8_t, this is fine because they are promoted to int,
>and the product of two uint8_ts fits in an int.
>
>However, when comp1_t is uint16, the product does not necessarily fit
>in an int, so casts are necessary.
>
>Fix for bug 43906, reported by Siarhei Siamashka.
>---
> pixman/pixman-combine.c.template |    6 +++---
> test/blitters-test.c             |    2 +-
> 2 files changed, 4 insertions(+), 4 deletions(-)
>
>diff --git a/pixman/pixman-combine.c.template b/pixman/pixman-combine.c.template
>index c17bcea..cd008d9 100644
>--- a/pixman/pixman-combine.c.template
>+++ b/pixman/pixman-combine.c.template
>@@ -522,7 +522,7 @@ combine_multiply_ca (pixman_implementation_t *imp,
> 	    UNcx4_MUL_UNc_ADD_UNcx4_MUL_UNc (result, isa, s, ida);	\
> 	    								\
> 	    *(dest + i) = result +					\
>-		(DIV_ONE_UNc (sa * da) << A_SHIFT) +			\
>+		(DIV_ONE_UNc (sa * (comp4_t)da) << A_SHIFT) +		\
> 		(blend_ ## name (RED_c (d), da, RED_c (s), sa) << R_SHIFT) + \
> 		(blend_ ## name (GREEN_c (d), da, GREEN_c (s), sa) << G_SHIFT) + \
> 		(blend_ ## name (BLUE_c (d), da, BLUE_c (s), sa));	\
>@@ -552,7 +552,7 @@ combine_multiply_ca (pixman_implementation_t *imp,
> 	    UNcx4_MUL_UNcx4_ADD_UNcx4_MUL_UNc (result, ~m, s, ida);     \
>             								\
> 	    result +=							\
>-	        (DIV_ONE_UNc (ALPHA_c (m) * da) << A_SHIFT) +		\
>+	        (DIV_ONE_UNc (ALPHA_c (m) * (comp4_t)da) << A_SHIFT) +	\
> 	        (blend_ ## name (RED_c (d), da, RED_c (s), RED_c (m)) << R_SHIFT) + \
> 	        (blend_ ## name (GREEN_c (d), da, GREEN_c (s), GREEN_c (m)) << G_SHIFT) + \
> 	        (blend_ ## name (BLUE_c (d), da, BLUE_c (s), BLUE_c (m))); \
>@@ -926,7 +926,7 @@ PDF_SEPARABLE_BLEND_MODE (exclusion)
> 	    blend_ ## name (c, dc, da, sc, sa);				\
>             								\
> 	    *(dest + i) = result +					\
>-		(DIV_ONE_UNc (sa * da) << A_SHIFT) +			\
>+		(DIV_ONE_UNc (sa * (comp4_t)da) << A_SHIFT) +		\
> 		(DIV_ONE_UNc (c[0]) << R_SHIFT) +			\
> 		(DIV_ONE_UNc (c[1]) << G_SHIFT) +			\
> 		(DIV_ONE_UNc (c[2]));					\
>diff --git a/test/blitters-test.c b/test/blitters-test.c
>index 55b6c73..63162e6 100644
>--- a/test/blitters-test.c
>+++ b/test/blitters-test.c
>@@ -424,6 +424,6 @@ main (int argc, const char *argv[])
>     }
> 
>     return fuzzer_test_main("blitters", 2000000,
>-			    0x29137844,
>+			    0x3EDA4108,
> 			    test_composite, argc, argv);
> }
>-- 
>1.6.0.6
>
>From 96f3fe506dcbae3aaa4aabc82a56002a436719e1 Mon Sep 17 00:00:00 2001
>From: =?utf-8?q?S=C3=B8ren=20Sandmann=20Pedersen?= <ssp@redhat.com>
>Date: Sun, 18 Dec 2011 09:54:47 -0500
>Subject: [PATCH] Add missing case in _pixman_edge_multi_init()
>
>nx and e->dy are both 32 bit quantities, so a cast is needed to make
>sure their product is 64 bit before subtracting it from a 64 bit
>quantity.
>---
> pixman/pixman-trap.c |    2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
>diff --git a/pixman/pixman-trap.c b/pixman/pixman-trap.c
>index c99f03e..adf5d7b 100644
>--- a/pixman/pixman-trap.c
>+++ b/pixman/pixman-trap.c
>@@ -139,7 +139,7 @@ _pixman_edge_multi_init (pixman_edge_t * e,
>     if (ne > 0)
>     {
> 	int nx = ne / e->dy;
>-	ne -= nx * e->dy;
>+	ne -= nx * (pixman_fixed_48_16_t)e->dy;
> 	stepx += nx * e->signdx;
>     }
> 
>-- 
>1.6.0.6
>

Actions: View | Splinter Review

Attachments on bug 43906: 54537

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.