[gegl] Bug 793937 - Crash in connection with median blur
- From: N/A <ell src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [gegl] Bug 793937 - Crash in connection with median blur
- Date: Wed, 28 Feb 2018 21:43:20 +0000 (UTC)
commit 8a69e32fe674deb5abc248b8e25eff16e4abbe9a
Author: Ell <ell_se yahoo com>
Date: Wed Feb 28 16:29:43 2018 -0500
Bug 793937 - Crash in connection with median blur
In convert_values_to_bins(), when quantize == FALSE, sort the
values *before* initializing prev_value, since it has to initially
correspond to the value of the first bin, i.e., the first value
after sorting. Failing to do this could lead to a buffer overflow
of bin_values, when all input values are unique.
operations/common/median-blur.c | 10 ++++++----
1 files changed, 6 insertions(+), 4 deletions(-)
---
diff --git a/operations/common/median-blur.c b/operations/common/median-blur.c
index 4debd6c..a8b1247 100644
--- a/operations/common/median-blur.c
+++ b/operations/common/median-blur.c
@@ -556,10 +556,14 @@ convert_values_to_bins (Histogram *hist,
for (c = 0; c < n_components; c++)
{
- gint bin = 0;
- gfloat prev_value = values[0].value;
+ gint bin = 0;
+ gfloat prev_value;
gfloat *bin_values;
+ sort_input_values (&values, &scratch, n_pixels);
+
+ prev_value = values[0].value;
+
bin_values = g_new (gfloat, n_pixels);
bin_values[0] = prev_value;
if (c == n_color_components)
@@ -568,8 +572,6 @@ convert_values_to_bins (Histogram *hist,
(gfloat) (1 << 10) + 0.5f);
}
- sort_input_values (&values, &scratch, n_pixels);
-
for (i = 0; i < n_pixels; i++)
{
gint32 *p = &src[values[i].index * n_components + c];
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]