[Pixman] [PATCH] Possible overrun in bilinear_interpolate_line_sse

[Makoto Kato]

Hi, all.

When width isn't multiples of 4 , it may cause buffer overrun in 
bilinear_interpolate_line_sse().  Because ((uint32)-1) & 2 is true.


-- Makoto
>From b32c3c3b8e6d48151f8d7bd1c71f7eb1d8a91762 Mon Sep 17 00:00:00 2001
From: Makoto Kato <m_k...@ga2.so-net.ne.jp>
Date: Fri, 27 May 2011 19:18:47 +0900
Subject: [PATCH] Possible overrun in bilinear_interpolate_line_sse

---
 pixman/pixman-sse2.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/pixman/pixman-sse2.c b/pixman/pixman-sse2.c
index 533b858..44b3ebe 100644
--- a/pixman/pixman-sse2.c
+++ b/pixman/pixman-sse2.c
@@ -5618,7 +5618,7 @@ bilinear_interpolate_line_sse2 (uint32_t *       out,
        pix = _mm_cvtsi128_si32 (a);                                            
\
     } while (0)
 
-    while ((width -= 4) >= 0)
+    while (width >= 4)
     {
        INTERPOLATE_ONE_PIXEL (pix1);
        INTERPOLATE_ONE_PIXEL (pix2);
@@ -5628,6 +5628,7 @@ bilinear_interpolate_line_sse2 (uint32_t *       out,
        *out++ = pix2;
        *out++ = pix3;
        *out++ = pix4;
+        width -= 4;
     }
     if (width & 2)
     {
-- 
1.7.4.1

_______________________________________________
Pixman mailing list
Pixman@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/pixman