From 9b817bc168903f9c44c2464b9b2f671ddf465f06 Mon Sep 17 00:00:00 2001 From: Antonioya Date: Tue, 31 Jul 2018 17:02:50 +0200 Subject: Fix set_pixel overflow in fill brush The value of the index was above the size of image --- source/blender/editors/gpencil/gpencil_fill.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'source') diff --git a/source/blender/editors/gpencil/gpencil_fill.c b/source/blender/editors/gpencil/gpencil_fill.c index 20db5c1504f..253f0db865e 100644 --- a/source/blender/editors/gpencil/gpencil_fill.c +++ b/source/blender/editors/gpencil/gpencil_fill.c @@ -372,6 +372,7 @@ static void get_pixel(ImBuf *ibuf, int idx, float r_col[4]) /* set pixel data (rgba) at index */ static void set_pixel(ImBuf *ibuf, int idx, const float col[4]) { + //BLI_assert(idx <= ibuf->x * ibuf->y); if (ibuf->rect) { uint *rrect = &ibuf->rect[idx]; uchar ccol[4]; @@ -587,20 +588,23 @@ static void gpencil_clean_borders(tGPDfill *tgpf) const float fill_col[4] = { 0.0f, 0.0f, 0.0f, 0.0f }; ibuf = BKE_image_acquire_ibuf(tgpf->ima, NULL, &lock); int idx; + int pixel = 0; /* horizontal lines */ - for (idx = 0; idx < ibuf->x; idx++) { + for (idx = 0; idx < ibuf->x - 1; idx++) { /* bottom line */ set_pixel(ibuf, idx, fill_col); /* top line */ - set_pixel(ibuf, idx + (ibuf->x * (ibuf->y - 1)), fill_col); + pixel = idx + (ibuf->x * (ibuf->y - 1)); + set_pixel(ibuf, pixel, fill_col); } /* vertical lines */ for (idx = 0; idx < ibuf->y; idx++) { /* left line */ set_pixel(ibuf, ibuf->x * idx, fill_col); /* right line */ - set_pixel(ibuf, ibuf->x * idx + (ibuf->x - 1), fill_col); + pixel = ibuf->x * idx + (ibuf->x - 1); + set_pixel(ibuf, pixel, fill_col); } /* release ibuf */ -- cgit v1.2.3