diff options
| author | Kim Motoyoshi Kalland <kim.kalland@nokia.com> | 2009-11-06 11:11:48 (GMT) |
|---|---|---|
| committer | Bradley T. Hughes <bradley.hughes@nokia.com> | 2009-11-06 13:07:40 (GMT) |
| commit | 0f73f9bab8e276890fd760bb7f88a63bdd45c520 (patch) | |
| tree | 98be2bdf935d5cffc46c67aaad809b77b891efc3 | |
| parent | 16a9dc214150b4531759b2ca43a2abb4f3cf7d99 (diff) | |
| download | Qt-0f73f9bab8e276890fd760bb7f88a63bdd45c520.zip Qt-0f73f9bab8e276890fd760bb7f88a63bdd45c520.tar.gz Qt-0f73f9bab8e276890fd760bb7f88a63bdd45c520.tar.bz2 | |
Fixed crash in qt_scale_image_16/32bit() when target is flipped.
If the target rectangle had negative width or height and the target
rectangle's border passed through pixel centres,
qt_scale_image_16/32bit() could crash because of incorrect rounding.
Task-number: 5493
Reviewed-by: Gunnar
| -rw-r--r-- | src/gui/painting/qblendfunctions.cpp | 40 |
1 files changed, 32 insertions, 8 deletions
diff --git a/src/gui/painting/qblendfunctions.cpp b/src/gui/painting/qblendfunctions.cpp index f8dd424..8737f10 100644 --- a/src/gui/painting/qblendfunctions.cpp +++ b/src/gui/painting/qblendfunctions.cpp @@ -223,11 +223,23 @@ void qt_scale_image_16bit(uchar *destPixels, int dbpl, int h = ty2 - ty1; int w = tx2 - tx1; - const int dstx = qCeil((tx1 + 0.5 - qMin(targetRect.left(), targetRect.right())) * ix) - 1; - const int dsty = qCeil((ty1 + 0.5 - qMin(targetRect.top(), targetRect.bottom())) * iy) - 1; + quint32 basex; + quint32 srcy; - quint32 basex = quint32((sx < 0 ? srcRect.right() : srcRect.left()) * 65536) + dstx; - quint32 srcy = quint32((sy < 0 ? srcRect.bottom() : srcRect.top()) * 65536) + dsty; + if (sx < 0) { + int dstx = qFloor((tx1 + 0.5 - targetRect.right()) * ix) + 1; + basex = quint32(srcRect.right() * 65536) + dstx; + } else { + int dstx = qCeil((tx1 + 0.5 - targetRect.left()) * ix) - 1; + basex = quint32(srcRect.left() * 65536) + dstx; + } + if (sy < 0) { + int dsty = qFloor((ty1 + 0.5 - targetRect.bottom()) * iy) + 1; + srcy = quint32(srcRect.bottom() * 65536) + dsty; + } else { + int dsty = qCeil((ty1 + 0.5 - targetRect.top()) * iy) - 1; + srcy = quint32(srcRect.top() * 65536) + dsty; + } quint16 *dst = ((quint16 *) (destPixels + ty1 * dbpl)) + tx1; @@ -723,11 +735,23 @@ template <typename T> void qt_scale_image_32bit(uchar *destPixels, int dbpl, int h = ty2 - ty1; int w = tx2 - tx1; - const int dstx = qCeil((tx1 + 0.5 - qMin(targetRect.left(), targetRect.right())) * ix) - 1; - const int dsty = qCeil((ty1 + 0.5 - qMin(targetRect.top(), targetRect.bottom())) * iy) - 1; + quint32 basex; + quint32 srcy; - quint32 basex = quint32((sx < 0 ? srcRect.right() : srcRect.left()) * 65536) + dstx; - quint32 srcy = quint32((sy < 0 ? srcRect.bottom() : srcRect.top()) * 65536) + dsty; + if (sx < 0) { + int dstx = qFloor((tx1 + 0.5 - targetRect.right()) * ix) + 1; + basex = quint32(srcRect.right() * 65536) + dstx; + } else { + int dstx = qCeil((tx1 + 0.5 - targetRect.left()) * ix) - 1; + basex = quint32(srcRect.left() * 65536) + dstx; + } + if (sy < 0) { + int dsty = qFloor((ty1 + 0.5 - targetRect.bottom()) * iy) + 1; + srcy = quint32(srcRect.bottom() * 65536) + dsty; + } else { + int dsty = qCeil((ty1 + 0.5 - targetRect.top()) * iy) - 1; + srcy = quint32(srcRect.top() * 65536) + dsty; + } quint32 *dst = ((quint32 *) (destPixels + ty1 * dbpl)) + tx1; |