45 lines
1.9 KiB
Text
45 lines
1.9 KiB
Text
|
See https://sourceforge.net/p/openil/patches/47/
|
||
|
|
|
||
|
|
From 5ab2eae2939463aba7fd7bf9a37cc43b9d8cdc43 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Jeff Epler <jepler@unpythonic.net>
|
||
|
|
Date: Thu, 3 Jun 2010 16:38:46 -0500
|
||
|
|
Subject: [PATCH] PR20713: fix out of bounds access in iluGaussian
|
||
|
|
|
||
|
|
the 'rightmost pixel' case in iluBlurGaussian was the same as the
|
||
|
|
'leftmost pixel' case, which makes it refer to pixels that are off the
|
||
|
|
right-hand side of the image by 1 or 2 pixels. In the final row they
|
||
|
|
are beyond the end of the image, and if the bytes just beyond the end of
|
||
|
|
the image are in an unmapped page, the program can segfault.
|
||
|
|
|
||
|
|
change the 'rightmost' case to use the pixels to the left of the pixel
|
||
|
|
being filtered instead.
|
||
|
|
|
||
|
|
Signed-off-by: Jeff Epler <jepler@unpythonic.net>
|
||
|
|
|
||
|
|
--- src-ILU/src/ilu_filter.c
|
||
|
|
+++ src-ILU/src/ilu_filter.c
|
||
|
|
@@ -378,14 +378,14 @@ ILubyte *Filter(ILimage *Image, const ILint *matrix, ILint scale, ILint bias)
|
||
|
|
}
|
||
|
|
for (c = 0; c < Image->Bpp; c++) {
|
||
|
|
Num = Image->Data[y - Image->Bps + c] * matrix[0] +
|
||
|
|
- Image->Data[y - Image->Bps + Image->Bpp + c] * matrix[1]+
|
||
|
|
- Image->Data[y - Image->Bps + 2 * Image->Bpp + c] * matrix[2]+
|
||
|
|
+ Image->Data[y - Image->Bps - Image->Bpp + c] * matrix[1]+
|
||
|
|
+ Image->Data[y - Image->Bps - 2 * Image->Bpp + c] * matrix[2]+
|
||
|
|
Image->Data[y + c] * matrix[3]+
|
||
|
|
- Image->Data[y + Image->Bpp + c] * matrix[4]+
|
||
|
|
- Image->Data[y + 2 * Image->Bpp + c] * matrix[5]+
|
||
|
|
+ Image->Data[y - Image->Bpp + c] * matrix[4]+
|
||
|
|
+ Image->Data[y - 2 * Image->Bpp + c] * matrix[5]+
|
||
|
|
Image->Data[y + Image->Bps + c] * matrix[6]+
|
||
|
|
- Image->Data[y + Image->Bps + Image->Bpp + c] * matrix[7]+
|
||
|
|
- Image->Data[y + Image->Bps + 2 * Image->Bpp + c] * matrix[8];
|
||
|
|
+ Image->Data[y + Image->Bps - Image->Bpp + c] * matrix[7]+
|
||
|
|
+ Image->Data[y + Image->Bps - 2 * Image->Bpp + c] * matrix[8];
|
||
|
|
|
||
|
|
Temp = (ILuint)fabs((Num / (ILdouble)scale) + bias);
|
||
|
|
if (Temp > 255)
|
||
|
|
--
|
||
|
|
1.7.1
|
||
|
|
|