Attempting to prevent invalid memory access...

...during linear gradient fill.

h/t Peter Link <peterlink3 on SourceForge>
https://sourceforge.net/p/tuxpaint/bugs/287/
This commit is contained in:
Bill Kendrick 2024-04-18 00:25:02 -07:00
parent d3e229ad47
commit 0aa370ba44
2 changed files with 44 additions and 34 deletions

View file

@ -6,7 +6,7 @@ Copyright (c) 2002-2024
Various contributors (see below, and AUTHORS.txt)
https://tuxpaint.org/
2024.April.12 (0.9.33)
2024.April.18 (0.9.33)
* New Magic Tools:
----------------
* WIP Specular Reflection: Draws a slightly blurred, wavy, and
@ -79,6 +79,13 @@ https://tuxpaint.org/
* Portuguese (Portugal) translation
Hugo Carvalho <hugokarvalho@hotmail.com>
* Bug Fixes:
----------
* Attempting to prevent invalid memory access during linear gradient fill.
h/t Peter Link <peterlink3 on SourceForge>
https://sourceforge.net/p/tuxpaint/bugs/287/
Bill Kendrick <bill@newbreedsoftware.com>
2024.January.29 (0.9.32)
* Improvements to Magic tools:
----------------------------

View file

@ -4,7 +4,7 @@
Fill tool
Tux Paint - A simple drawing program for children.
Copyright (c) 2002-2023 by Bill Kendrick and others; see AUTHORS.txt
Copyright (c) 2002-2024 by Bill Kendrick and others; see AUTHORS.txt
bill@newbreedsoftware.com
https://tuxpaint.org/
@ -27,7 +27,7 @@
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
(See COPYING.txt)
Last updated: February 26, 2023
Last updated: April 18, 2024
$Id$
*/
@ -572,10 +572,12 @@ void draw_linear_gradient(SDL_Surface * canvas, SDL_Surface * last,
/* FIXME: C2 should be larger than C1? */
for (yy = y_top; yy <= y_bottom; yy++)
{
if (yy >= 0 && yy < canvas->h)
{
for (xx = x_left; xx <= x_right; xx++)
{
if (touched[(yy * canvas->w) + xx])
if (xx >= 0 && xx < canvas->w && touched[(yy * canvas->w) + xx])
{
/* Get the old color, and blend it (with a distance-based ratio) with the target color */
old_colr = getpixels[last->format->BytesPerPixel] (last, xx, yy);
@ -613,6 +615,7 @@ void draw_linear_gradient(SDL_Surface * canvas, SDL_Surface * last,
}
}
}
}
}
void draw_brush_fill_single(SDL_Surface * canvas, int x, int y, Uint32 draw_color, Uint8 * touched)