Fixed crash in qt_scale_image_16/32bit() when target is flipped.

If the target rectangle had negative width or height and the target
rectangle's border passed through pixel centres,
qt_scale_image_16/32bit() could crash because of incorrect rounding.

Task-number: 5493
Reviewed-by: Gunnar

1 files changed, 32 insertions, 8 deletions

diff --git a/src/gui/painting/qblendfunctions.cpp b/src/gui/painting/qblendfunctions.cpp
index f8dd424..8737f10 100644
--- a/src/gui/painting/qblendfunctions.cpp
+++ b/src/gui/painting/qblendfunctions.cpp
@@ -223,11 +223,23 @@ void qt_scale_image_16bit(uchar *destPixels, int dbpl,
     int h = ty2 - ty1;
     int w = tx2 - tx1;
 
-    const int dstx = qCeil((tx1 + 0.5 - qMin(targetRect.left(), targetRect.right())) * ix) - 1;
-    const int dsty = qCeil((ty1 + 0.5 - qMin(targetRect.top(), targetRect.bottom())) * iy) - 1;
+    quint32 basex;
+    quint32 srcy;
 
-    quint32 basex = quint32((sx < 0 ? srcRect.right() : srcRect.left()) * 65536) + dstx;
-    quint32 srcy = quint32((sy < 0 ? srcRect.bottom() : srcRect.top()) * 65536) + dsty;
+    if (sx < 0) {
+        int dstx = qFloor((tx1 + 0.5 - targetRect.right()) * ix) + 1;
+        basex = quint32(srcRect.right() * 65536) + dstx;
+    } else {
+        int dstx = qCeil((tx1 + 0.5 - targetRect.left()) * ix) - 1;
+        basex = quint32(srcRect.left() * 65536) + dstx;
+    }
+    if (sy < 0) {
+        int dsty = qFloor((ty1 + 0.5 - targetRect.bottom()) * iy) + 1;
+        srcy = quint32(srcRect.bottom() * 65536) + dsty;
+    } else {
+        int dsty = qCeil((ty1 + 0.5 - targetRect.top()) * iy) - 1;
+        srcy = quint32(srcRect.top() * 65536) + dsty;
+    }
 
     quint16 *dst = ((quint16 *) (destPixels + ty1 * dbpl)) + tx1;
 
@@ -723,11 +735,23 @@ template <typename T> void qt_scale_image_32bit(uchar *destPixels, int dbpl,
     int h = ty2 - ty1;
     int w = tx2 - tx1;
 
-    const int dstx = qCeil((tx1 + 0.5 - qMin(targetRect.left(), targetRect.right())) * ix) - 1;
-    const int dsty = qCeil((ty1 + 0.5 - qMin(targetRect.top(), targetRect.bottom())) * iy) - 1;
+    quint32 basex;
+    quint32 srcy;
 
-    quint32 basex = quint32((sx < 0 ? srcRect.right() : srcRect.left()) * 65536) + dstx;
-    quint32 srcy = quint32((sy < 0 ? srcRect.bottom() : srcRect.top()) * 65536) + dsty;
+    if (sx < 0) {
+        int dstx = qFloor((tx1 + 0.5 - targetRect.right()) * ix) + 1;
+        basex = quint32(srcRect.right() * 65536) + dstx;
+    } else {
+        int dstx = qCeil((tx1 + 0.5 - targetRect.left()) * ix) - 1;
+        basex = quint32(srcRect.left() * 65536) + dstx;
+    }
+    if (sy < 0) {
+        int dsty = qFloor((ty1 + 0.5 - targetRect.bottom()) * iy) + 1;
+        srcy = quint32(srcRect.bottom() * 65536) + dsty;
+    } else {
+        int dsty = qCeil((ty1 + 0.5 - targetRect.top()) * iy) - 1;
+        srcy = quint32(srcRect.top() * 65536) + dsty;
+    }
 
     quint32 *dst = ((quint32 *) (destPixels + ty1 * dbpl)) + tx1;