You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
hartwork
changed the title
[0.4.x] heap-use-after-free in method PixPort::Fade of actor "gforce"
[0.4.x] Plugin "gforce": heap-use-after-free in method PixPort::Fade
Feb 7, 2023
My guess is that Fade() is sampling outside of the inSrce buffer due to either some arithmetic error in the Fade() function, or the population of the grad array argument.
This is the critical path:
#defineHALFCORD0x007F/* 16 bits per cord, 8 bits for fixed decimal, 8 bits for whole number */
...
// Setup the source row base address and offset to allow for negative grad components
srce = inSrce - HALFCORD * inBytesPerRow - HALFCORD;
...
// Format of each long:// High byte: x (whole part), High-low byte: x (frac part)// Low-high byte: y (whole part), Low byte: y (frac part)
u1 = *grad;
grad++;
...
srceMap = srce + ( u1 >> 14 );
v = ( u1 >> 7 ) & 0x7F; // frac part of x
u = ( u1 ) & 0x7F; // frac part of y
...
/* Bilinear interpolation to approximate the source pixel value... *//* P1 - P2 *//* | | *//* P3 - P4 */
P1 = ( (unsignedchar*) srceMap )[0];
P2 = ( (unsignedchar*) srceMap )[1];
...
P3 = ( (unsignedchar*) srceMap )[ inBytesPerRow ];
P4 = ( (unsignedchar*) srceMap )[ inBytesPerRow + 1 ];
(0x7F is 1111111)
So, grad contains uint32_t values that each encode a 2D point or vector in fixed point. However, the code and comments disagree on how!
The code appears to indicate that the fractional parts of x and y are encoded in bits 7-13 and bits 0-6 respectively. On the other hand, the comment ("Format of each long ...") indicates that x and y are encoded in the high and low word respectively.
I ran into this unfixed heap-use-after-free today:
The text was updated successfully, but these errors were encountered: