AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix overflow bug in slow span.

Browse Source 
Fix an overflow in the address calculation in the sampler.

BUG=chromium:700836

Change-Id: Ifadbdc9541138219e8aec08c1342a241da75705c
Reviewed-on: https://skia-review.googlesource.com/9815
Reviewed-by: Mike Reed <reed@google.com>
Commit-Queue: Herb Derby <herb@google.com>
This commit is contained in:
Herb Derby 2017-03-16 16:43:13 -04:00 committed by Skia Commit-Bot
parent 9bc39bbd1a
commit 2fb3662364
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/core/SkLinearBitmapPipeline_sample.h
View File

@ -13,7 +13,7 @@
#include "SkAutoMalloc.h"
#include "SkColor.h"
#include "SkColorPriv.h"
#include "SkFixed.h"
#include "SkFixed.h" // for SkFixed1 only. Don't use SkFixed in this file.
#include "SkHalf.h"
#include "SkLinearBitmapPipeline_core.h"
#include "SkNx.h"
@ -388,15 +388,17 @@ private:
SkPoint start; SkScalar length; int count;
std::tie(start, length, count) = span;
SkScalar x = X(start);
SkFixed fx = SkScalarToFixed(x);
// fx is a fixed 48.16 number.
int64_t fx = static_cast<int64_t>(x * SK_Fixed1);
SkScalar dx = length / (count - 1);
SkFixed fdx = SkScalarToFixed(dx);
// fdx is a fixed 48.16 number.
int64_t fdx = static_cast<int64_t>(dx * SK_Fixed1);
const void* row = fAccessor.row((int)std::floor(Y(start)));
Next* next = fNext;
int ix = SkFixedFloorToInt(fx);
int prevIX = ix;
int64_t ix = fx >> 16;
int64_t prevIX = ix;
Sk4f fpixel = fAccessor.getPixelFromRow(row, ix);
// When dx is less than one, each pixel is used more than once. Using the fixed point fx
@ -408,7 +410,7 @@ private:
prevIX = ix;
}
fx += fdx;
ix = SkFixedFloorToInt(fx);
ix = fx >> 16;
return fpixel;
};