mirror/aseprite
1
0
Fork 0
mirror of https://github.com/aseprite/aseprite.git synced 2025-03-18 07:21:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix usage of freed memory after check_flood_line() returns true when 8-connectivity is used

Browse Source
This commit is contained in:
David Capello 2020-01-02 18:39:23 -03:00
parent c1d5f8eb0a
commit 8efb11915f
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/doc/algorithm/floodfill.cpp
View File

@ -393,7 +393,6 @@ void floodfill(const Image* image,
// For each line on the screen
for (int c=0; c<flood_count; c++) {
p = FLOOD_LINE(c);
// Check below the segment?
@ -446,28 +445,35 @@ void floodfill(const Image* image,
check_flood_line(image, mask, p->y-1, p->lpos+1, p->rpos, bounds,
src_color, tolerance, data, proc)) {
done = false;
p = FLOOD_LINE(c);
}
if (p->lpos-1 >= 0 &&
check_flood_line(image, mask, p->y-1, p->lpos-1, p->rpos, bounds,
src_color, tolerance, data, proc)) {
done = false;
p = FLOOD_LINE(c);
}
if (p->rpos+1 < bounds.x2() &&
check_flood_line(image, mask, p->y-1, p->lpos, p->rpos+1, bounds,
src_color, tolerance, data, proc)) {
done = false;
p = FLOOD_LINE(c);
}
if (p->rpos-1 >= 0 &&
check_flood_line(image, mask, p->y-1, p->lpos, p->rpos-1, bounds,
src_color, tolerance, data, proc)) {
done = false;
p = FLOOD_LINE(c);
}
}
if (check_flood_line(image, mask, p->y-1, p->lpos, p->rpos, bounds,
src_color, tolerance, data, proc)) {
done = false;
// Special case shortcut for going backwards
if ((c > bounds.y) && (c < bounds.y2()))
c -= 2;