summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorwolfbeast <mcwerewolf@wolfbeast.com>2019-09-01 16:39:40 +0200
committerwolfbeast <mcwerewolf@wolfbeast.com>2019-09-01 16:39:40 +0200
commit09a8b2f19689b679b1268a3004ec5e3f37b9732a (patch)
treec40e7cf0cb5d4e95cf55a6a25e5c4638f9462472
parentf67e3f054fcdd04e78a7779ec7e7f44643ec47e5 (diff)
downloadUXP-09a8b2f19689b679b1268a3004ec5e3f37b9732a.tar
UXP-09a8b2f19689b679b1268a3004ec5e3f37b9732a.tar.gz
UXP-09a8b2f19689b679b1268a3004ec5e3f37b9732a.tar.lz
UXP-09a8b2f19689b679b1268a3004ec5e3f37b9732a.tar.xz
UXP-09a8b2f19689b679b1268a3004ec5e3f37b9732a.zip
Correctly return zero vertices if clipping plane 0 or 2 clip away the
entire polygon. This fixes a regression caused by the fix for CVE-2016-5252
-rw-r--r--gfx/2d/Matrix.h24
1 files changed, 13 insertions, 11 deletions
diff --git a/gfx/2d/Matrix.h b/gfx/2d/Matrix.h
index 22a01ca10..84c9a5280 100644
--- a/gfx/2d/Matrix.h
+++ b/gfx/2d/Matrix.h
@@ -734,7 +734,8 @@ public:
// Initialize a double-buffered array of points in homogenous space with
// the input rectangle, aRect.
Point4DTyped<UnknownUnits, F> points[2][kTransformAndClipRectMaxVerts];
- Point4DTyped<UnknownUnits, F>* dstPoint = points[0];
+ Point4DTyped<UnknownUnits, F>* dstPointStart = points[0];
+ Point4DTyped<UnknownUnits, F>* dstPoint = dstPointStart;
*dstPoint++ = TransformPoint(Point4DTyped<UnknownUnits, F>(aRect.x, aRect.y, 0, 1));
*dstPoint++ = TransformPoint(Point4DTyped<UnknownUnits, F>(aRect.XMost(), aRect.y, 0, 1));
@@ -754,11 +755,11 @@ public:
// points[1].
for (int plane=0; plane < 4; plane++) {
planeNormals[plane].Normalize();
- Point4DTyped<UnknownUnits, F>* srcPoint = points[plane & 1];
+ Point4DTyped<UnknownUnits, F>* srcPoint = dstPointStart;
Point4DTyped<UnknownUnits, F>* srcPointEnd = dstPoint;
- dstPoint = points[~plane & 1];
- Point4DTyped<UnknownUnits, F>* dstPointStart = dstPoint;
+ dstPointStart = points[~plane & 1];
+ dstPoint = dstPointStart;
Point4DTyped<UnknownUnits, F>* prevPoint = srcPointEnd - 1;
F prevDot = planeNormals[plane].DotProduct(*prevPoint);
@@ -787,10 +788,10 @@ public:
}
}
- size_t dstPointCount = 0;
- size_t srcPointCount = dstPoint - points[0];
- for (Point4DTyped<UnknownUnits, F>* srcPoint = points[0]; srcPoint < points[0] + srcPointCount; srcPoint++) {
-
+ Point4DTyped<UnknownUnits, F>* srcPoint = dstPointStart;
+ Point4DTyped<UnknownUnits, F>* srcPointEnd = dstPoint;
+ size_t vertCount = 0;
+ while (srcPoint < srcPointEnd) {
PointTyped<TargetUnits, F> p;
if (srcPoint->w == 0.0) {
// If a point lies on the intersection of the clipping planes at
@@ -800,12 +801,13 @@ public:
p = srcPoint->As2DPoint();
}
// Emit only unique points
- if (dstPointCount == 0 || p != aVerts[dstPointCount - 1]) {
- aVerts[dstPointCount++] = p;
+ if (vertCount == 0 || p != aVerts[vertCount - 1]) {
+ aVerts[vertCount++] = p;
}
+ srcPoint++;
}
- return dstPointCount;
+ return vertCount;
}
static const int kTransformAndClipRectMaxVerts = 32;