Skip to content

Commit b90542e

Browse files
committed
Ensure large offsets do not result in SEGV
[skip ci]
1 parent e7d8e85 commit b90542e

File tree

2 files changed

+8
-5
lines changed

2 files changed

+8
-5
lines changed

libvips/resample/reduceh.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,8 @@ vips_reduceh_gen( VipsRegion *out_region, void *seq,
309309

310310
s.left = r->left * reduceh->hshrink;
311311
s.top = r->top;
312-
s.width = r->width * reduceh->hshrink + reduceh->n_point;
312+
s.width = r->width * reduceh->hshrink + reduceh->n_point
313+
+ reduceh->hoffset;
313314
s.height = r->height;
314315
if( vips_region_prepare( ir, &s ) )
315316
return( -1 );
@@ -494,7 +495,7 @@ vips_reduceh_build( VipsObject *object )
494495
*/
495496
if( vips_embed( in, &t[1],
496497
left, 0,
497-
in->Xsize + reduceh->n_point - 1, in->Ysize,
498+
in->Xsize + reduceh->n_point + reduceh->hoffset, in->Ysize,
498499
"extend", VIPS_EXTEND_COPY,
499500
(void *) NULL ) )
500501
return( -1 );

libvips/resample/reducev.cpp

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -536,7 +536,8 @@ vips_reducev_gen( VipsRegion *out_region, void *vseq,
536536
s.left = r->left;
537537
s.top = r->top * reducev->vshrink;
538538
s.width = r->width;
539-
s.height = r->height * reducev->vshrink + reducev->n_point;
539+
s.height = r->height * reducev->vshrink + reducev->n_point
540+
+ reducev->voffset;
540541
if( vips_region_prepare( ir, &s ) )
541542
return( -1 );
542543

@@ -650,7 +651,8 @@ vips_reducev_vector_gen( VipsRegion *out_region, void *vseq,
650651
s.left = r->left;
651652
s.top = r->top * reducev->vshrink;
652653
s.width = r->width;
653-
s.height = r->height * reducev->vshrink + reducev->n_point;
654+
s.height = r->height * reducev->vshrink + reducev->n_point
655+
+ reducev->voffset;
654656
if( vips_region_prepare( ir, &s ) )
655657
return( -1 );
656658

@@ -873,7 +875,7 @@ vips_reducev_build( VipsObject *object )
873875
*/
874876
if( vips_embed( in, &t[1],
875877
0, top,
876-
in->Xsize, in->Ysize + reducev->n_point - 1,
878+
in->Xsize, in->Ysize + reducev->n_point + reducev->voffset,
877879
"extend", VIPS_EXTEND_COPY,
878880
(void *) NULL ) )
879881
return( -1 );

0 commit comments

Comments
 (0)