diff options
| author | Samuel Rødal <samuel.rodal@nokia.com> | 2010-12-08 15:46:09 (GMT) |
|---|---|---|
| committer | Samuel Rødal <samuel.rodal@nokia.com> | 2010-12-08 16:21:02 (GMT) |
| commit | d7294806fc43e8611c4441881e511af5f18c60db (patch) | |
| tree | 3895b96cfa8d95965f061e828f0f6a354e9874d9 | |
| parent | e5b6414f5b28a93c917380fb57f56d0ca46f2961 (diff) | |
| download | Qt-d7294806fc43e8611c4441881e511af5f18c60db.zip Qt-d7294806fc43e8611c4441881e511af5f18c60db.tar.gz Qt-d7294806fc43e8611c4441881e511af5f18c60db.tar.bz2 | |
Prevent out-of-bounds memory access in drawhelper.
The coordinates should be modulo the image width and height like for all
the other tiled blend functions.
Covered by perspectives.qps
Task-number: QTBUG-15837
Reviewed-by: Olivier Goffart
| -rw-r--r-- | src/gui/painting/qdrawhelper.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/gui/painting/qdrawhelper.cpp b/src/gui/painting/qdrawhelper.cpp index a4ab278..024a69d 100644 --- a/src/gui/painting/qdrawhelper.cpp +++ b/src/gui/painting/qdrawhelper.cpp @@ -6432,6 +6432,8 @@ Q_STATIC_TEMPLATE_FUNCTION void blendTransformedTiled(int count, const QSpan *sp int px = int(tx) - (tx < 0); int py = int(ty) - (ty < 0); + px %= image_width; + py %= image_height; if (px < 0) px += image_width; if (py < 0) |