nilix/openbox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a write out of bounds in splitvertical gradients (Bug 3612)

Browse source 
If the gradient has height 1, then y1sz is 0. We don't want to use the
first color and move the data pointer, since this will move it past the
end of the array.
This commit is contained in:
Dana Jansens 2013-08-11 16:04:50 -04:00
parent cddd736de5
commit f3873cac4a
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
obrender/gradient.c
View file

@ -527,13 +527,15 @@ static void gradient_splitvertical(RrAppearance *a, gint w, gint h)
/* find the color for the first pixel of each row first */
data = sf->pixel_data;
for (y1 = y1sz-1; y1 > 0; --y1) {
if (y1sz) {
for (y1 = y1sz-1; y1 > 0; --y1) {
*data = COLOR(y1);
data += w;
NEXT(y1);
}
*data = COLOR(y1);
data += w;
NEXT(y1);
}
*data = COLOR(y1);
data += w;
if (y2sz) {
for (y2 = y2sz-1; y2 > 0; --y2) {
*data = COLOR(y2);