This is an automated email from the git hooks/post-receive script.
git pushed a commit to branch fix-release-build
in repository efl.
View the commit online.
commit cc9a65414f00c07ef26d450ea9b4d6723fdc5809
Author: Cedric BAIL <[email protected]>
AuthorDate: Sun Aug 2 19:37:38 2026 -0600
evas: fix span length clobber in copy_rel pixel x mask
_op_copy_rel_p_mas_dp() used l, the span *length* parameter, as the
scratch for the interpolation factor:
color = *m;
...
default:
c = MUL_SYM(*d >> 24, *s);
l++;
*d = INTERP_256(l, c, *d);
This is a botched port of the i386 idiom, where the mask is deliberately
loaded into l first (l = *m) so that l++ really is mask + 1, and where
the loop bound is a precomputed pointer so clobbering l is harmless. The
generic C version renamed the scratch to "color" but left the l++ behind,
which has two consequences:
- the interpolation factor is the running span length instead of the
mask value, so every pixel with a non-trivial mask is wrong;
- UNROLL8_PLD_WHILE re-reads size after the main loop to size the tail
(end += (size & 7)), so mutating l corrupts the tail bound and the
kernel writes past the destination span.
Use color, matching the point version right below it, which already does
INTERP_256(m + 1, c, *d). This is C, not NEON: every architecture is
affected. The NEON file carries a verbatim copy of the same kernel, so
fix it there too.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_.c | 4 ++--
src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_neon.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_.c b/src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_.c
index 12c2dace3a..36a7110d93 100644
--- a/src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_.c
+++ b/src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_.c
@@ -87,8 +87,8 @@ _op_copy_rel_p_mas_dp(DATA32 *s, DATA8 *m, DATA32 c, DATA32 *d, int l) {
break;
default:
c = MUL_SYM(*d >> 24, *s);
- l++;
- *d = INTERP_256(l, c, *d);
+ color++;
+ *d = INTERP_256(color, c, *d);
break;
}
m++; s++; d++;
diff --git a/src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_neon.c b/src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_neon.c
index c3b35ee8c8..38bf35b5c7 100644
--- a/src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_neon.c
+++ b/src/lib/evas/common/evas_op_copy/op_copy_pixel_mask_neon.c
@@ -93,8 +93,8 @@ _op_copy_rel_p_mas_dp_neon(DATA32 *s, DATA8 *m, DATA32 c EINA_UNUSED, DATA32 *d,
break;
default:
c = MUL_SYM(*d >> 24, *s);
- l++;
- *d = INTERP_256(l, c, *d);
+ color++;
+ *d = INTERP_256(color, c, *d);
break;
}
m++; s++; d++;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
