Off-by-one-line error in QVGPaintEngine::drawImage

QVGPaintEngine::drawImage(const QPointF &pos, const QImage &image) uses
vgWritePixels if possible, and when the QImage is loaded from some file
types, its lines are inverted, stored from bottom to top in memory.

For inverted images, the image data pointer passed to vgWritePixels
should be pointing at the start of the last line. However drawImage was
actually passing a pointer to after the last line. This has undefined
results, but in practice you either get the image contents drawn one
line too high with the top line missing and and extra garbage bottom
line, or you can also get a crash if beyond the last line is not
readable memory.

Fixed by correcting the pointer passed to vgWritePixels to point to
the start of the last line for inverted images.

Task-number: ou1cimx1#996894
Change-Id: I1cf5b976acc18adceec1e14633f8779441faa056
Reviewed-by: Jani Hautakangas <jani.hautakangas@nokia.com>
Reviewed-by: Pasi Pentikäinen <ext-pasi.a.pentikainen@nokia.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/src/openvg/qpaintengine_vg.cpp b/src/openvg/qpaintengine_vg.cpp
index d8b45de..d0ad6b2 100644
--- a/src/openvg/qpaintengine_vg.cpp
+++ b/src/openvg/qpaintengine_vg.cpp
@@ -3441,7 +3441,7 @@ void QVGPaintEngine::drawImage(const QPointF &pos, const QImage &image)
     if (canVgWritePixels(image)) {
         // Optimization for straight blits, no blending
         bool inverted = (d->imageTransform.m22() < 0);
-        const uchar *bits = inverted ? image.constBits() + image.byteCount() : image.constBits();
+        const uchar *bits = inverted ? image.constBits() + image.byteCount() - image.bytesPerLine() : image.constBits();
         int bpl = inverted ? -image.bytesPerLine() : image.bytesPerLine();
 
         QPointF mapped = d->imageTransform.map(pos);