From 35fcd15d0598bca6a265100ace5d10a0d992cf9c Mon Sep 17 00:00:00 2001 From: sugoi Date: Wed, 11 Jun 2014 06:31:29 -0700 Subject: Support for larger than "signed 32b limit" sized bitmaps in BGRAConvolve2D. The multiplication of 2 signed ints was producing a result larger than what's supported by a single signed int and the memory was accessed out of bounds. Using uint64_t solves the issue. BUG=378491 R=reed@google.com, rmistry@google.com Author: sugoi@chromium.org Review URL: https://codereview.chromium.org/323013005 --- src/core/SkConvolver.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/core/SkConvolver.cpp b/src/core/SkConvolver.cpp index 7666e6fadc..0e97fac07f 100644 --- a/src/core/SkConvolver.cpp +++ b/src/core/SkConvolver.cpp @@ -405,7 +405,7 @@ void BGRAConvolve2D(const unsigned char* sourceData, const unsigned char* src[4]; unsigned char* outRow[4]; for (int i = 0; i < 4; ++i) { - src[i] = &sourceData[(nextXRow + i) * sourceByteRowStride]; + src[i] = &sourceData[(uint64_t)(nextXRow + i) * sourceByteRowStride]; outRow[i] = rowBuffer.advanceRow(); } convolveProcs.fConvolve4RowsHorizontally(src, filterX, outRow); @@ -416,16 +416,16 @@ void BGRAConvolve2D(const unsigned char* sourceData, nextXRow < lastFilterOffset + lastFilterLength - avoidSimdRows) { convolveProcs.fConvolveHorizontally( - &sourceData[nextXRow * sourceByteRowStride], + &sourceData[(uint64_t)nextXRow * sourceByteRowStride], filterX, rowBuffer.advanceRow(), sourceHasAlpha); } else { if (sourceHasAlpha) { ConvolveHorizontally( - &sourceData[nextXRow * sourceByteRowStride], + &sourceData[(uint64_t)nextXRow * sourceByteRowStride], filterX, rowBuffer.advanceRow()); } else { ConvolveHorizontally( - &sourceData[nextXRow * sourceByteRowStride], + &sourceData[(uint64_t)nextXRow * sourceByteRowStride], filterX, rowBuffer.advanceRow()); } } -- cgit v1.2.3