Embedded/lvgl
1
0
Fork 0
mirror of https://github.com/lvgl/lvgl.git synced 2025-01-14 06:42:58 +08:00
Code Issues Projects Releases Wiki Activity

fix(draw): fix set_px_cb memory write overflow crash. (#2882)

Browse Source
This commit is contained in:
Neo 2021-12-07 20:46:02 +08:00 committed by GitHub
parent 43729d1502
commit e50950683d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/draw/sw/lv_draw_sw_blend.c
View File

@ -420,8 +420,6 @@ static void map_set_px(lv_color_t * dest_buf, lv_coord_t dest_stride, const lv_a
int32_t src_stride = lv_area_get_width(src_area); int32_t src_stride = lv_area_get_width(src_area);
dest_buf += dest_stride * clip_area->y1 + clip_area->x1;
src_buf += src_stride * (clip_area->y1 - src_area->y1); src_buf += src_stride * (clip_area->y1 - src_area->y1);
src_buf += (clip_area->x1 - src_area->x1); src_buf += (clip_area->x1 - src_area->x1);
@ -430,7 +428,7 @@ static void map_set_px(lv_color_t * dest_buf, lv_coord_t dest_stride, const lv_a
if(mask == NULL) { if(mask == NULL) {
for(y = 0; y < clip_h; y++) { for(y = 0; y < clip_h; y++) {
for(x = 0; x <= clip_w; x++) { for(x = 0; x < clip_w; x++) {
disp->driver->set_px_cb(disp->driver, (void *)dest_buf, dest_stride, clip_area->x1 + x, clip_area->y1 + y, src_buf[x], disp->driver->set_px_cb(disp->driver, (void *)dest_buf, dest_stride, clip_area->x1 + x, clip_area->y1 + y, src_buf[x],
opa); opa);
} }
@ -439,7 +437,7 @@ static void map_set_px(lv_color_t * dest_buf, lv_coord_t dest_stride, const lv_a
} }
else { else {
for(y = 0; y < clip_h; y++) { for(y = 0; y < clip_h; y++) {
for(x = 0; x <= clip_w; x++) { for(x = 0; x < clip_w; x++) {
if(mask[x]) { if(mask[x]) {
disp->driver->set_px_cb(disp->driver, (void *)dest_buf, dest_stride, clip_area->x1 + x, clip_area->y1 + y, src_buf[x], disp->driver->set_px_cb(disp->driver, (void *)dest_buf, dest_stride, clip_area->x1 + x, clip_area->y1 + y, src_buf[x],
(uint32_t)((uint32_t)opa * mask[x]) >> 8); (uint32_t)((uint32_t)opa * mask[x]) >> 8);