From: JunsuChoi <jsuya.choi@samsung.com>
Date: Thu, 18 Mar 2021 08:10:05 +0000 (+0900)
Subject: ector image: Prevents drawing images outside buffer
X-Git-Tag: accepted/tizen/unified/20210330.111316~12
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=74530296b30cd4d7592cc6423c80a4899407e9a8;p=platform%2Fupstream%2Fefl.git

ector image: Prevents drawing images outside buffer

Summary:
A crash may occur when image size is set larger than buffer.
So, modify boundary of the image drawing the image
so that it does not go out of the buffer.

Test Plan: N/A

Reviewers: Hermet

Reviewed By: Hermet

Subscribers: cedric, #reviewers, #committers, kimcinoo

Tags: #efl

Differential Revision: https://phab.enlightenment.org/D12251

Change-Id: Ia2857c21c6805abc40973e6ab7375fc81331c979
---

diff --git a/src/lib/ector/software/ector_renderer_software_image.c b/src/lib/ector/software/ector_renderer_software_image.c
index f933bd6..d7807ed 100644
--- a/src/lib/ector/software/ector_renderer_software_image.c
+++ b/src/lib/ector/software/ector_renderer_software_image.c
@@ -106,6 +106,10 @@ _ector_renderer_software_image_ector_renderer_draw(Eo *obj EINA_UNUSED,
    double im11, im12, im21, im22, im31, im32;
    uint32_t *dst_buf, *src_buf;
    int image_w, image_h;
+
+   int dst_buf_width = MIN(pd->boundary.x2, (int)pd->surface->rasterizer->fill_data.raster_buffer->generic->w);
+   int dst_buf_height = MIN(pd->boundary.y2, (int)pd->surface->rasterizer->fill_data.raster_buffer->generic->h);
+
    ector_buffer_size_get(pd->image->buffer, &image_w, &image_h);
 
    dst_buf = pd->surface->rasterizer->fill_data.raster_buffer->pixels.u32;
@@ -116,9 +120,9 @@ _ector_renderer_software_image_ector_renderer_draw(Eo *obj EINA_UNUSED,
                                        &im31, &im32, NULL);
 
    //Draw
-   for (int local_y = pd->boundary.y1; local_y < pd->boundary.y2; local_y++)
+   for (int local_y = pd->boundary.y1; local_y < dst_buf_height; local_y++)
      {
-        for (int local_x = pd->boundary.x1; local_x <  pd->boundary.x2; local_x++)
+        for (int local_x = pd->boundary.x1; local_x <  dst_buf_width; local_x++)
           {
              uint32_t *dst = dst_buf + ((int)local_x + ((int)local_y * pix_stride));
              int rx, ry;