Image: Remove std::vector out-of-bounds access when filling polygons
While iterating through `active_edges` we call `std::next`. If the current
iterator is `.end()` we are accessing out-of-bound memory.
Make sure we always have a valid iterator past `it` in the loop.
Follow-up on 6642ca4515
This commit is contained in:
parent
e8adf5d331
commit
339cfd49bc
|
@ -2513,10 +2513,16 @@ void Image::Fill(Rgb colour, int density, const Polygon &polygon) {
|
||||||
++it;
|
++it;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Not enough edges to perform the fill operation.
|
||||||
|
// Continue to next line.
|
||||||
|
if (active_edges.size() < 2) {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
std::sort(active_edges.begin(), active_edges.end(), PolygonFill::Edge::CompareX);
|
std::sort(active_edges.begin(), active_edges.end(), PolygonFill::Edge::CompareX);
|
||||||
|
|
||||||
if (!(scan_line % density)) {
|
if (!(scan_line % density)) {
|
||||||
for (auto it = active_edges.begin(); it != active_edges.end(); ++it) {
|
for (auto it = active_edges.begin(); it < active_edges.end() - 1; ++it) {
|
||||||
int32 lo_x = static_cast<int32>(it->min_x);
|
int32 lo_x = static_cast<int32>(it->min_x);
|
||||||
int32 hi_x = static_cast<int32>(std::next(it)->min_x);
|
int32 hi_x = static_cast<int32>(std::next(it)->min_x);
|
||||||
if (colours == ZM_COLOUR_GRAY8) {
|
if (colours == ZM_COLOUR_GRAY8) {
|
||||||
|
|
Loading…
Reference in New Issue