Fix crash in wxImage::Scale()

Caused by arithmetic overflow of a signed addition and subsequent
right-shift of that (now negative) value and use as an array index.
Could only realistically occur on platforms where long is 32 bits.
See #18550
This commit is contained in:
Paul Cornett
2019-10-29 19:59:31 -07:00
parent 9e4d28ba7f
commit 94ac1bbc85

View File

@@ -526,21 +526,21 @@ wxImage wxImage::ResampleNearest(int width, int height) const
} }
} }
long old_height = M_IMGDATA->m_height, const unsigned long old_height = M_IMGDATA->m_height;
old_width = M_IMGDATA->m_width; const unsigned long old_width = M_IMGDATA->m_width;
long x_delta = (old_width<<16) / width; const unsigned long x_delta = (old_width << 16) / width;
long y_delta = (old_height<<16) / height; const unsigned long y_delta = (old_height << 16) / height;
unsigned char* dest_pixel = target_data; unsigned char* dest_pixel = target_data;
long y = 0; unsigned long y = 0;
for ( long j = 0; j < height; j++ ) for (int j = 0; j < height; j++)
{ {
const unsigned char* src_line = &source_data[(y>>16)*old_width*3]; const unsigned char* src_line = &source_data[(y>>16)*old_width*3];
const unsigned char* src_alpha_line = source_alpha ? &source_alpha[(y>>16)*old_width] : 0 ; const unsigned char* src_alpha_line = source_alpha ? &source_alpha[(y>>16)*old_width] : 0 ;
long x = 0; unsigned long x = 0;
for ( long i = 0; i < width; i++ ) for (int i = 0; i < width; i++)
{ {
const unsigned char* src_pixel = &src_line[(x>>16)*3]; const unsigned char* src_pixel = &src_line[(x>>16)*3];
const unsigned char* src_alpha_pixel = source_alpha ? &src_alpha_line[(x>>16)] : 0 ; const unsigned char* src_alpha_pixel = source_alpha ? &src_alpha_line[(x>>16)] : 0 ;