Commit: 9b817bc168903f9c44c2464b9b2f671ddf465f06
Author: Antonioya
Date:   Tue Jul 31 17:02:50 2018 +0200
Branches: blender2.8
https://developer.blender.org/rB9b817bc168903f9c44c2464b9b2f671ddf465f06

Fix set_pixel overflow in fill brush

The value of the index was above the size of image

===================================================================

M       source/blender/editors/gpencil/gpencil_fill.c

===================================================================

diff --git a/source/blender/editors/gpencil/gpencil_fill.c 
b/source/blender/editors/gpencil/gpencil_fill.c
index 20db5c1504f..253f0db865e 100644
--- a/source/blender/editors/gpencil/gpencil_fill.c
+++ b/source/blender/editors/gpencil/gpencil_fill.c
@@ -372,6 +372,7 @@ static void get_pixel(ImBuf *ibuf, int idx, float r_col[4])
 /* set pixel data (rgba) at index */
 static void set_pixel(ImBuf *ibuf, int idx, const float col[4])
 {
+       //BLI_assert(idx <= ibuf->x * ibuf->y);
        if (ibuf->rect) {
                uint *rrect = &ibuf->rect[idx];
                uchar ccol[4];
@@ -587,20 +588,23 @@ static void gpencil_clean_borders(tGPDfill *tgpf)
        const float fill_col[4] = { 0.0f, 0.0f, 0.0f, 0.0f };
        ibuf = BKE_image_acquire_ibuf(tgpf->ima, NULL, &lock);
        int idx;
+       int pixel = 0;
 
        /* horizontal lines */
-       for (idx = 0; idx < ibuf->x; idx++) {
+       for (idx = 0; idx < ibuf->x - 1; idx++) {
                /* bottom line */
                set_pixel(ibuf, idx, fill_col);
                /* top line */
-               set_pixel(ibuf, idx + (ibuf->x * (ibuf->y - 1)), fill_col);
+               pixel = idx + (ibuf->x * (ibuf->y - 1));
+               set_pixel(ibuf, pixel, fill_col);
        }
        /* vertical lines */
        for (idx = 0; idx < ibuf->y; idx++) {
                /* left line */
                set_pixel(ibuf, ibuf->x * idx, fill_col);
                /* right line */
-               set_pixel(ibuf, ibuf->x * idx + (ibuf->x - 1), fill_col);
+               pixel = ibuf->x * idx + (ibuf->x - 1);
+               set_pixel(ibuf, pixel, fill_col);
        }
 
        /* release ibuf */

_______________________________________________
Bf-blender-cvs mailing list
Bf-blender-cvs@blender.org
https://lists.blender.org/mailman/listinfo/bf-blender-cvs

Reply via email to