diff options
| author |  sugoi <sugoi@chromium.org> | 2014-06-11 06:31:29 -0700 |
|---|---|---|
| committer |  Commit bot <commit-bot@chromium.org> | 2014-06-11 06:31:29 -0700 |
| commit | 35fcd15d0598bca6a265100ace5d10a0d992cf9c (patch) | |
| tree | 5fa2766e0e276546441890050d8040edbf5292a6 /src/core/SkConvolver.cpp | |
| parent | e4538f5b46d70798e34eb078f5d5e76a59d02318 (diff) | |
Support for larger than "signed 32b limit" sized bitmaps in BGRAConvolve2D.
The multiplication of 2 signed ints was producing a result larger than what's supported by a single signed int and the memory was accessed out of bounds. Using uint64_t solves the issue.
BUG=378491
R=reed@google.com, rmistry@google.com
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/323013005
Diffstat (limited to 'src/core/SkConvolver.cpp')
| -rw-r--r-- | src/core/SkConvolver.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/core/SkConvolver.cpp b/src/core/SkConvolver.cpp index 7666e6fadc..0e97fac07f 100644 --- a/src/core/SkConvolver.cpp +++ b/src/core/SkConvolver.cpp @@ -405,7 +405,7 @@ void BGRAConvolve2D(const unsigned char* sourceData, const unsigned char* src[4]; unsigned char* outRow[4]; for (int i = 0; i < 4; ++i) { - src[i] = &sourceData[(nextXRow + i) * sourceByteRowStride]; + src[i] = &sourceData[(uint64_t)(nextXRow + i) * sourceByteRowStride]; outRow[i] = rowBuffer.advanceRow(); } convolveProcs.fConvolve4RowsHorizontally(src, filterX, outRow); @@ -416,16 +416,16 @@ void BGRAConvolve2D(const unsigned char* sourceData, nextXRow < lastFilterOffset + lastFilterLength - avoidSimdRows) { convolveProcs.fConvolveHorizontally( - &sourceData[nextXRow * sourceByteRowStride], + &sourceData[(uint64_t)nextXRow * sourceByteRowStride], filterX, rowBuffer.advanceRow(), sourceHasAlpha); } else { if (sourceHasAlpha) { ConvolveHorizontally<true>( - &sourceData[nextXRow * sourceByteRowStride], + &sourceData[(uint64_t)nextXRow * sourceByteRowStride], filterX, rowBuffer.advanceRow()); } else { ConvolveHorizontally<false>( - &sourceData[nextXRow * sourceByteRowStride], + &sourceData[(uint64_t)nextXRow * sourceByteRowStride], filterX, rowBuffer.advanceRow()); } } |