From c186d400e597ad30c5b8c0277567baa376cf48bd Mon Sep 17 00:00:00 2001 From: Jindrich Makovicka Date: Thu, 26 May 2011 10:43:51 +0200 Subject: [PATCH] textrender: Add bound checks to not write outside the image area --- ext/pango/gsttextrender.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/ext/pango/gsttextrender.c b/ext/pango/gsttextrender.c index eaa4742..c0129f5 100644 --- a/ext/pango/gsttextrender.c +++ b/ext/pango/gsttextrender.c @@ -380,8 +380,10 @@ gst_text_render_fixate_caps (GstPad * pad, GstCaps * caps) GstStructure *s = gst_caps_get_structure (caps, 0); GST_DEBUG ("Fixating caps %" GST_PTR_FORMAT, caps); - gst_structure_fixate_field_nearest_int (s, "width", render->image_width); - gst_structure_fixate_field_nearest_int (s, "height", render->image_height); + gst_structure_fixate_field_nearest_int (s, "width", MAX (render->image_width, + DEFAULT_RENDER_WIDTH)); + gst_structure_fixate_field_nearest_int (s, "height", + MAX (render->image_height + render->ypad, DEFAULT_RENDER_HEIGHT)); GST_DEBUG ("Fixated to %" GST_PTR_FORMAT, caps); gst_object_unref (render); @@ -404,12 +406,12 @@ gst_text_renderer_image_to_ayuv (GstTextRender * render, guchar * pixbuf, width = render->image_width; height = render->image_height; - bitp = render->text_image; - for (y = 0; y < height; y++) { + for (y = 0; y < height && ypos + y < render->height; y++) { int n; p = pixbuf + (ypos + y) * stride + xpos * 4; - for (n = 0; n < width; n++) { + bitp = render->text_image + y * width * 4; + for (n = 0; n < width && n < render->width; n++) { b = bitp[CAIRO_ARGB_B]; g = bitp[CAIRO_ARGB_G]; r = bitp[CAIRO_ARGB_R]; @@ -440,11 +442,11 @@ gst_text_renderer_image_to_argb (GstTextRender * render, guchar * pixbuf, width = render->image_width; height = render->image_height; - bitp = render->text_image; - for (i = 0; i < height; i++) { + for (i = 0; i < height && ypos + i < render->height; i++) { p = pixbuf + (ypos + i) * stride + xpos * 4; - for (j = 0; j < width; j++) { + bitp = render->text_image + i * width * 4; + for (j = 0; j < width && j < render->width; j++) { p[0] = bitp[CAIRO_ARGB_A]; p[1] = bitp[CAIRO_ARGB_R]; p[2] = bitp[CAIRO_ARGB_G]; -- 2.7.4