Image: Remove std::vector out-of-bounds access when filling polygons

While iterating through `active_edges` we call `std::next`. If the current
iterator is `.end()` we are accessing out-of-bound memory.
Make sure we always have a valid iterator past `it` in the loop.

Follow-up on 6642ca4515
This commit is contained in:
Peter Keresztes Schmidt 2021-05-29 19:58:19 +02:00
parent e8adf5d331
commit 339cfd49bc
1 changed files with 7 additions and 1 deletions

View File

@ -2513,10 +2513,16 @@ void Image::Fill(Rgb colour, int density, const Polygon &polygon) {
++it; ++it;
} }
} }
// Not enough edges to perform the fill operation.
// Continue to next line.
if (active_edges.size() < 2) {
continue;
}
std::sort(active_edges.begin(), active_edges.end(), PolygonFill::Edge::CompareX); std::sort(active_edges.begin(), active_edges.end(), PolygonFill::Edge::CompareX);
if (!(scan_line % density)) { if (!(scan_line % density)) {
for (auto it = active_edges.begin(); it != active_edges.end(); ++it) { for (auto it = active_edges.begin(); it < active_edges.end() - 1; ++it) {
int32 lo_x = static_cast<int32>(it->min_x); int32 lo_x = static_cast<int32>(it->min_x);
int32 hi_x = static_cast<int32>(std::next(it)->min_x); int32 hi_x = static_cast<int32>(std::next(it)->min_x);
if (colours == ZM_COLOUR_GRAY8) { if (colours == ZM_COLOUR_GRAY8) {