wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-04 14:58:37 +09:00
Code Issues Projects Releases Packages Wiki Activity

Correctly return zero vertices if clipping plane 0 or 2 clip away the

Browse source 
entire polygon.

This fixes a regression caused by the fix for CVE-2016-5252
This commit is contained in:
wolfbeast 2019-09-01 16:39:40 +02:00 • committed by Roy Tam
commit de215d77fc
1 changed files with 13 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

24
gfx/2d/Matrix.h
View file

@ -734,7 +734,8 @@ public:
// Initialize a double-buffered array of points in homogenous space with
// the input rectangle, aRect.
Point4DTyped<UnknownUnits, F> points[2][kTransformAndClipRectMaxVerts];
Point4DTyped<UnknownUnits, F>* dstPoint = points[0];
Point4DTyped<UnknownUnits, F>* dstPointStart = points[0];
Point4DTyped<UnknownUnits, F>* dstPoint = dstPointStart;
*dstPoint++ = TransformPoint(Point4DTyped<UnknownUnits, F>(aRect.x, aRect.y, 0, 1));
*dstPoint++ = TransformPoint(Point4DTyped<UnknownUnits, F>(aRect.XMost(), aRect.y, 0, 1));
@ -754,11 +755,11 @@ public:
// points[1].
for (int plane=0; plane < 4; plane++) {
planeNormals[plane].Normalize();
Point4DTyped<UnknownUnits, F>* srcPoint = points[plane & 1];
Point4DTyped<UnknownUnits, F>* srcPoint = dstPointStart;
Point4DTyped<UnknownUnits, F>* srcPointEnd = dstPoint;
dstPoint = points[~plane & 1];
Point4DTyped<UnknownUnits, F>* dstPointStart = dstPoint;
dstPointStart = points[~plane & 1];
dstPoint = dstPointStart;
Point4DTyped<UnknownUnits, F>* prevPoint = srcPointEnd - 1;
F prevDot = planeNormals[plane].DotProduct(*prevPoint);
@ -787,10 +788,10 @@ public:
}
}
size_t dstPointCount = 0;
size_t srcPointCount = dstPoint - points[0];
for (Point4DTyped<UnknownUnits, F>* srcPoint = points[0]; srcPoint < points[0] + srcPointCount; srcPoint++) {
Point4DTyped<UnknownUnits, F>* srcPoint = dstPointStart;
Point4DTyped<UnknownUnits, F>* srcPointEnd = dstPoint;
size_t vertCount = 0;
while (srcPoint < srcPointEnd) {
PointTyped<TargetUnits, F> p;
if (srcPoint->w == 0.0) {
// If a point lies on the intersection of the clipping planes at
@ -800,12 +801,13 @@ public:
p = srcPoint->As2DPoint();
}
// Emit only unique points
if (dstPointCount == 0 || p != aVerts[dstPointCount - 1]) {
aVerts[dstPointCount++] = p;
if (vertCount == 0 || p != aVerts[vertCount - 1]) {
aVerts[vertCount++] = p;
}
srcPoint++;
}
return dstPointCount;
return vertCount;
}
static const int kTransformAndClipRectMaxVerts = 32;