Embedded/lvgl
1
0
Fork 0
mirror of https://github.com/lvgl/lvgl.git synced 2025-01-21 06:53:01 +08:00
Code Issues Projects Releases Wiki Activity

mask: fix write out-of-bounds of mask_buf

Browse Source
This commit is contained in:
Gabor Kiss-Vamosi 2019-10-02 07:03:53 +02:00
parent 3761987d32
commit 1edeba573f
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/lv_draw/lv_draw_mask.c
View File

@ -411,7 +411,7 @@ static lv_draw_mask_res_t line_mask_flat(lv_opa_t * mask_buf, lv_coord_t abs_x,
lv_opa_t m; lv_opa_t m;
if(xef) { if(xef) {
if(k >= 0) { if(k >= 0 && k < len) {
m = 255 - (((255-xef) * (255 - px_h)) >> 9); m = 255 - (((255-xef) * (255 - px_h)) >> 9);
if(p->inv) m = 255 - m; if(p->inv) m = 255 - m;
mask_buf[k] = mask_mix(mask_buf[k], m); mask_buf[k] = mask_mix(mask_buf[k], m);
@ -420,7 +420,7 @@ static lv_draw_mask_res_t line_mask_flat(lv_opa_t * mask_buf, lv_coord_t abs_x,
} }
while(px_h > p->spx) { while(px_h > p->spx) {
if(k >= 0) { if(k >= 0 && k < len) {
m = px_h - (p->spx >> 1); m = px_h - (p->spx >> 1);
if(p->inv) m = 255 - m; if(p->inv) m = 255 - m;
mask_buf[k] = mask_mix(mask_buf[k], m); mask_buf[k] = mask_mix(mask_buf[k], m);
@ -429,6 +429,8 @@ static lv_draw_mask_res_t line_mask_flat(lv_opa_t * mask_buf, lv_coord_t abs_x,
k++; k++;
if(k >= len) break; if(k >= len) break;
} }
if(k < len && k >= 0) { if(k < len && k >= 0) {
int32_t x_inters = (px_h * p->xy_steep) >> 10; int32_t x_inters = (px_h * p->xy_steep) >> 10;
m = (x_inters * px_h) >> 9; m = (x_inters * px_h) >> 9;
@ -437,6 +439,7 @@ static lv_draw_mask_res_t line_mask_flat(lv_opa_t * mask_buf, lv_coord_t abs_x,
mask_buf[k] = mask_mix(mask_buf[k], m); mask_buf[k] = mask_mix(mask_buf[k], m);
} }
if(p->inv) { if(p->inv) {
k = xei - abs_x; k = xei - abs_x;
if(k > len) { if(k > len) {