[gegl] c2g/stress: avoid out of bounds array access



commit fe1dd6e3a606dd110417717eb89d23d6f9d32c3c
Author: Øyvind Kolås <pippin gimp org>
Date:   Tue Jul 16 13:46:30 2019 +0200

    c2g/stress: avoid out of bounds array access
    
    It wouldn't happen single threaded, but with our random LUT buffers being
    iterated and shared between threads ; we could end up reading one or two
    entries past the end during some races.

 operations/common/envelopes.h | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)
---
diff --git a/operations/common/envelopes.h b/operations/common/envelopes.h
index 9ae5943a3..e769a11a8 100644
--- a/operations/common/envelopes.h
+++ b/operations/common/envelopes.h
@@ -37,9 +37,9 @@ static void compute_luts(gint rgamma)
 
   for (i=0;i<ANGLE_PRIME;i++)
     {
-      angle += golden_angle;
       lut_cos[i] = cos(angle);
       lut_sin[i] = sin(angle);
+      angle += golden_angle;
     }
   for (i=0;i<RADIUS_PRIME;i++)
     {
@@ -80,8 +80,9 @@ sample_min_max (GeglBuffer  *buffer,
   for (i=0; i<samples; i++)
     {
       gint u, v;
-      gint angle;
       gfloat rmag;
+      gint angle;
+      gint rad_no;
       gint max_retries = samples;
 
 retry:                      /* if we've sampled outside the valid image
@@ -90,13 +91,18 @@ retry:                      /* if we've sampled outside the valid image
                                or extending with an abyss policy
                              */
       angle = angle_no++;
-      rmag = radiuses[radius_no++] * radius;
+      rad_no = radius_no ++;
 
       if (angle_no>=ANGLE_PRIME)
         angle_no=0;
+      if (angle>=ANGLE_PRIME)
+        angle=0;
       if (radius_no>=RADIUS_PRIME)
         radius_no=0;
+      if (rad_no>=RADIUS_PRIME)
+        rad_no=0;
 
+      rmag = radiuses[rad_no] * radius;
       u = x + rmag * lut_cos[angle];
       v = y + rmag * lut_sin[angle];
 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]