pixman: Branch 'master'

[GitLab Mirror]

 pixman/pixman-fast-path.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

New commits:
commit 348e99b52f41caf32f8b7840e53f0b1322716c47
Author: Adam Jackson <ajax at redhat.com>
Date:   Thu Mar 26 18:08:17 2020 -0400

    fast-path: Fix some sketchy pointer arithmetic
    
    We want a uint8_t * at the end of this math, because that's what the
    function we're about to pass it to takes. But ->bits is a uint32_t, so
    if we just do the math in units of that we can avoid the explicit factor
    of four which would risk an integer overflow.
    
    Fixes: pixman/pixman#14

diff --git a/pixman/pixman-fast-path.c b/pixman/pixman-fast-path.c
index 1ba779b..4b7a6f8 100644
--- a/pixman/pixman-fast-path.c
+++ b/pixman/pixman-fast-path.c
@@ -2800,7 +2800,7 @@ bits_image_fetch_separable_convolution_affine (pixman_image_t * image,
 			    repeat (repeat_mode, &rx, bits->width);
 			    repeat (repeat_mode, &ry, bits->height);
 
-			    row = (uint8_t *)bits->bits + bits->rowstride * 4 * ry;
+			    row = (uint8_t *)(bits->bits + bits->rowstride * ry);
 			    pixel = convert_pixel (row, rx) | mask;
 			}
 			else
@@ -2811,7 +2811,7 @@ bits_image_fetch_separable_convolution_affine (pixman_image_t * image,
 			    }
 			    else
 			    {
-				row = (uint8_t *)bits->bits + bits->rowstride * 4 * ry;
+				row = (uint8_t *)(bits->bits + bits->rowstride * ry);
 				pixel = convert_pixel (row, rx) | mask;
 			    }
 			}
@@ -2913,8 +2913,8 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image,
 	    repeat (repeat_mode, &x2, width);
 	    repeat (repeat_mode, &y2, height);
 
-	    row1 = (uint8_t *)bits->bits + bits->rowstride * 4 * y1;
-	    row2 = (uint8_t *)bits->bits + bits->rowstride * 4 * y2;
+	    row1 = (uint8_t *)(bits->bits + bits->rowstride * y1);
+	    row2 = (uint8_t *)(bits->bits + bits->rowstride * y2);
 
 	    tl = convert_pixel (row1, x1) | mask;
 	    tr = convert_pixel (row1, x2) | mask;
@@ -2949,7 +2949,7 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image,
 	    }
 	    else
 	    {
-		row1 = (uint8_t *)bits->bits + bits->rowstride * 4 * y1;
+		row1 = (uint8_t *)(bits->bits + bits->rowstride * y1);
 		row1 += bpp / 8 * x1;
 
 		mask1 = PIXMAN_FORMAT_A (format)? 0 : 0xff000000;
@@ -2962,7 +2962,7 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image,
 	    }
 	    else
 	    {
-		row2 = (uint8_t *)bits->bits + bits->rowstride * 4 * y2;
+		row2 = (uint8_t *)(bits->bits + bits->rowstride * y2);
 		row2 += bpp / 8 * x1;
 
 		mask2 = PIXMAN_FORMAT_A (format)? 0 : 0xff000000;
@@ -3060,7 +3060,7 @@ bits_image_fetch_nearest_affine (pixman_image_t * image,
 		repeat (repeat_mode, &y0, height);
 	    }
 
-	    row = (uint8_t *)bits->bits + bits->rowstride * 4 * y0;
+	    row = (uint8_t *)(bits->bits + bits->rowstride * y0);
 
 	    buffer[i] = convert_pixel (row, x0) | mask;
 	}