From 725e7cd0d77028790ab80279ec65bcb8bc13eee7 Mon Sep 17 00:00:00 2001 From: Carsten Haitzler Date: Thu, 27 Jan 2011 02:59:49 +0000 Subject: [PATCH] protect against people providing out-of-bounds u&v coords in map. SVN revision: 56313 --- legacy/evas/src/lib/canvas/evas_object_image.c | 4 ++++ legacy/evas/src/lib/canvas/evas_render.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/legacy/evas/src/lib/canvas/evas_object_image.c b/legacy/evas/src/lib/canvas/evas_object_image.c index d43b522564..e66f83b7bf 100644 --- a/legacy/evas/src/lib/canvas/evas_object_image.c +++ b/legacy/evas/src/lib/canvas/evas_object_image.c @@ -2477,6 +2477,10 @@ evas_object_image_render(Evas_Object *obj, void *output, void *context, void *su pt->fz = p->z; pt->u = p->u * FP1; pt->v = p->v * FP1; + if (pt->u < 0) pt->u = 0; + else if (pt->u > (o->cur.image.w * FP1)) pt->u = (o->cur.image.w * FP1); + if (pt->v < 0) pt->v = 0; + else if (pt->v > (o->cur.image.h * FP1)) pt->v = (o->cur.image.h * FP1); pt->col = ARGB_JOIN(p->a, p->r, p->g, p->b); } obj->layer->evas->engine.func->image_map4_draw diff --git a/legacy/evas/src/lib/canvas/evas_render.c b/legacy/evas/src/lib/canvas/evas_render.c index 3b2659ee71..5e852142a3 100644 --- a/legacy/evas/src/lib/canvas/evas_render.c +++ b/legacy/evas/src/lib/canvas/evas_render.c @@ -733,6 +733,10 @@ evas_render_mapped(Evas *e, Evas_Object *obj, void *context, void *surface, pt->fz = p->z; pt->u = p->u * FP1; pt->v = p->v * FP1; + if (pt->u < 0) pt->u = 0; + else if (pt->u > (sw * FP1)) pt->u = (sw * FP1); + if (pt->v < 0) pt->v = 0; + else if (pt->v > (sh * FP1)) pt->v = (sh * FP1); pt->col = ARGB_JOIN(p->a, p->r, p->g, p->b); }