diff options
| author | Robin Watts <Robin.Watts@artifex.com> | 2019-10-31 10:31:24 +0000 |
|---|---|---|
| committer | Robin Watts <Robin.Watts@artifex.com> | 2019-10-31 10:33:53 +0000 |
| commit | bf72f1a3dd5392ee8291e3b1518a0c2c5dc6ba39 (patch) | |
| tree | ba93d27d920f7f88d177a684b09242b9b9774aa7 | |
| parent | fa7f0cde80ce734ddc22bde34d121c1be5c7deb4 (diff) | |
Fix valgrind problems with gdevbjca.c
2 problems here. Firstly, we could access off the end of a row
while looking for runs. Change the indexing to fix this.
Secondly, we could overrun our gamma tables due to unexpectedly
large values. Add some clamping.
| -rw-r--r-- | contrib/gdevbjca.c | 36 |
1 files changed, 22 insertions, 14 deletions
diff --git a/contrib/gdevbjca.c b/contrib/gdevbjca.c index a023f0ee0..3573f55a9 100644 --- a/contrib/gdevbjca.c +++ b/contrib/gdevbjca.c @@ -342,12 +342,14 @@ bjc_compress(const byte *row, uint raster, byte *compressed) register byte test, test2; test = *exam; - while ( exam < end_row ) { - test2 = *++exam; + while ( ++exam < end_row ) { + test2 = *exam; if ( test == test2 ) break; test = test2; } + /* exam points to the byte that didn't match, or end_row + * if we ran out of data. */ /* Find out how long the run is */ end_dis = exam - 1; @@ -655,12 +657,15 @@ FloydSteinbergDitheringC(gx_device_bjc_printer *dev, for( i=width; i>0; i--, row+=4, err_vect+=3) { /*separate components */ /* C + K */ - err_corrC = dev->bjc_gamma_tableC[ (*row) + (*(row+3))] - + dev->FloydSteinbergC; - err_corrM = dev->bjc_gamma_tableM[(*(row+1)) + (*(row+3))] - + dev->FloydSteinbergM; - err_corrY = dev->bjc_gamma_tableY[(*(row+2)) + (*(row+3))] - + dev->FloydSteinbergY; + int v = row[0] + row[3]; + if (v > 255) v = 255; + err_corrC = dev->bjc_gamma_tableC[v] + dev->FloydSteinbergC; + v = row[1] + row[3]; + if (v > 255) v = 255; + err_corrM = dev->bjc_gamma_tableM[v] + dev->FloydSteinbergM; + v = row[2] + row[3]; + if (v > 255) v = 255; + err_corrY = dev->bjc_gamma_tableY[v] + dev->FloydSteinbergY; if(err_corrC > 4080 && limit_extr) err_corrC = 4080; if(err_corrM > 4080 && limit_extr) err_corrM = 4080; @@ -751,12 +756,15 @@ FloydSteinbergDitheringC(gx_device_bjc_printer *dev, for( i=width; i>0; i--, row-=4, err_vect-=3) { - err_corrC = dev->bjc_gamma_tableC[ (*row) + (*(row+3))] - + dev->FloydSteinbergC; - err_corrM = dev->bjc_gamma_tableM[(*(row+1)) + (*(row+3))] - + dev->FloydSteinbergM; - err_corrY = dev->bjc_gamma_tableY[(*(row+2)) + (*(row+3))] - + dev->FloydSteinbergY; + int v = row[0] + row[3]; + if (v > 255) v = 255; + err_corrC = dev->bjc_gamma_tableC[v] + dev->FloydSteinbergC; + v = row[1] + row[3]; + if (v > 255) v = 255; + err_corrM = dev->bjc_gamma_tableM[v] + dev->FloydSteinbergM; + v = row[2] + row[3]; + if (v > 255) v = 255; + err_corrY = dev->bjc_gamma_tableY[v] + dev->FloydSteinbergY; if(err_corrC > 4080 && limit_extr) err_corrC = 4080; if(err_corrM > 4080 && limit_extr) err_corrM = 4080; |
