Support for larger than "signed 32b limit" sized bitmaps in BGRAConvolve2D.
The multiplication of 2 signed ints was producing a result larger than what's supported by a single signed int and the memory was accessed out of bounds. Using uint64_t solves the issue.
BUG=378491
R=reed@google.com, rmistry@google.com
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/323013005
diff --git a/src/core/SkConvolver.cpp b/src/core/SkConvolver.cpp
index 7666e6f..0e97fac 100644
--- a/src/core/SkConvolver.cpp
+++ b/src/core/SkConvolver.cpp
@@ -405,7 +405,7 @@
const unsigned char* src[4];
unsigned char* outRow[4];
for (int i = 0; i < 4; ++i) {
- src[i] = &sourceData[(nextXRow + i) * sourceByteRowStride];
+ src[i] = &sourceData[(uint64_t)(nextXRow + i) * sourceByteRowStride];
outRow[i] = rowBuffer.advanceRow();
}
convolveProcs.fConvolve4RowsHorizontally(src, filterX, outRow);
@@ -416,16 +416,16 @@
nextXRow < lastFilterOffset + lastFilterLength -
avoidSimdRows) {
convolveProcs.fConvolveHorizontally(
- &sourceData[nextXRow * sourceByteRowStride],
+ &sourceData[(uint64_t)nextXRow * sourceByteRowStride],
filterX, rowBuffer.advanceRow(), sourceHasAlpha);
} else {
if (sourceHasAlpha) {
ConvolveHorizontally<true>(
- &sourceData[nextXRow * sourceByteRowStride],
+ &sourceData[(uint64_t)nextXRow * sourceByteRowStride],
filterX, rowBuffer.advanceRow());
} else {
ConvolveHorizontally<false>(
- &sourceData[nextXRow * sourceByteRowStride],
+ &sourceData[(uint64_t)nextXRow * sourceByteRowStride],
filterX, rowBuffer.advanceRow());
}
}
