textrender: Add bound checks to not write outside the image area

diff --git a/ext/pango/gsttextrender.c b/ext/pango/gsttextrender.c
index eaa4742..c0129f5 100644 (file)
--- a/ext/pango/gsttextrender.c
+++ b/ext/pango/gsttextrender.c
@@ -380,8 +380,10 @@ gst_text_render_fixate_caps (GstPad * pad, GstCaps * caps)
   GstStructure *s = gst_caps_get_structure (caps, 0);
 
   GST_DEBUG ("Fixating caps %" GST_PTR_FORMAT, caps);
-  gst_structure_fixate_field_nearest_int (s, "width", render->image_width);
-  gst_structure_fixate_field_nearest_int (s, "height", render->image_height);
+  gst_structure_fixate_field_nearest_int (s, "width", MAX (render->image_width,
+          DEFAULT_RENDER_WIDTH));
+  gst_structure_fixate_field_nearest_int (s, "height",
+      MAX (render->image_height + render->ypad, DEFAULT_RENDER_HEIGHT));
   GST_DEBUG ("Fixated to    %" GST_PTR_FORMAT, caps);
 
   gst_object_unref (render);
@@ -404,12 +406,12 @@ gst_text_renderer_image_to_ayuv (GstTextRender * render, guchar * pixbuf,
 
   width = render->image_width;
   height = render->image_height;
-  bitp = render->text_image;
 
-  for (y = 0; y < height; y++) {
+  for (y = 0; y < height && ypos + y < render->height; y++) {
     int n;
     p = pixbuf + (ypos + y) * stride + xpos * 4;
-    for (n = 0; n < width; n++) {
+    bitp = render->text_image + y * width * 4;
+    for (n = 0; n < width && n < render->width; n++) {
       b = bitp[CAIRO_ARGB_B];
       g = bitp[CAIRO_ARGB_G];
       r = bitp[CAIRO_ARGB_R];
@@ -440,11 +442,11 @@ gst_text_renderer_image_to_argb (GstTextRender * render, guchar * pixbuf,
 
   width = render->image_width;
   height = render->image_height;
-  bitp = render->text_image;
 
-  for (i = 0; i < height; i++) {
+  for (i = 0; i < height && ypos + i < render->height; i++) {
     p = pixbuf + (ypos + i) * stride + xpos * 4;
-    for (j = 0; j < width; j++) {
+    bitp = render->text_image + i * width * 4;
+    for (j = 0; j < width && j < render->width; j++) {
       p[0] = bitp[CAIRO_ARGB_A];
       p[1] = bitp[CAIRO_ARGB_R];
       p[2] = bitp[CAIRO_ARGB_G];