From 17a883b991636e01d34ba129589c111ff09fb154 Mon Sep 17 00:00:00 2001 From: Evgeny Voevodin Date: Wed, 27 Jun 2012 13:13:02 +0400 Subject: [PATCH] tizen/src/sdl_rotate.c: Fix buffer overrun error reported by efence Destination pixel is calculated using four source pixels. When source pixel is got from last line or row next rigth or bottom pixel could be not existent since we reached the end of src->pixels. Signed-off-by: Evgeny Voevodin --- tizen/src/sdl_rotate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tizen/src/sdl_rotate.c b/tizen/src/sdl_rotate.c index e268c97..8f07edc 100644 --- a/tizen/src/sdl_rotate.c +++ b/tizen/src/sdl_rotate.c @@ -638,7 +638,7 @@ void _transformSurfaceRGBA(SDL_Surface * src, SDL_Surface * dst, int cx, int cy, for (x = 0; x < dst->w; x++) { dx = (sdx >> 16); dy = (sdy >> 16); - if ((dx > -1) && (dy > -1) && (dx < src->w) && (dy < src->h)) { + if ((dx > -1) && (dy > -1) && (dx < src->w - 1) && (dy < src->h - 1)) { if (flipx) dx = sw - dx; if (flipy) dy = sh - dy; sp = (tColorRGBA *) ((Uint8 *) src->pixels + src->pitch * dy); -- 2.7.4