From: Evgeny Voevodin <e.voevodin@samsung.com>
Date: Wed, 27 Jun 2012 09:13:02 +0000 (+0400)
Subject: tizen/src/sdl_rotate.c: Fix buffer overrun error reported by efence
X-Git-Tag: Tizen_Studio_1.3_Release_p2.3.1~1405^2~93
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=17a883b991636e01d34ba129589c111ff09fb154;p=sdk%2Femulator%2Fqemu.git

tizen/src/sdl_rotate.c: Fix buffer overrun error reported by efence

Destination pixel is calculated using four source pixels. When source
pixel is got from last line or row next rigth or bottom pixel could
be not existent since we reached the end of src->pixels.

Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>
---

diff --git a/tizen/src/sdl_rotate.c b/tizen/src/sdl_rotate.c
index e268c97ff6..8f07edc9ad 100644
--- a/tizen/src/sdl_rotate.c
+++ b/tizen/src/sdl_rotate.c
@@ -638,7 +638,7 @@ void _transformSurfaceRGBA(SDL_Surface * src, SDL_Surface * dst, int cx, int cy,
 			for (x = 0; x < dst->w; x++) {
 				dx = (sdx >> 16);
 				dy = (sdy >> 16);
-				if ((dx > -1) && (dy > -1) && (dx < src->w) && (dy < src->h)) {
+				if ((dx > -1) && (dy > -1) && (dx < src->w - 1) && (dy < src->h - 1)) {
 					if (flipx) dx = sw - dx;
 					if (flipy) dy = sh - dy;
 					sp = (tColorRGBA *) ((Uint8 *) src->pixels + src->pitch * dy);