[Bf-blender-cvs] SVN commit: /data/svn/bf-blender [27795] trunk/blender/source/blender/ blenfont/intern/blf_font.c: fix for writing out of buffer bounds when drawing to a buffer ( most obvious with new grid type but could probably crash with stamp render option too )

[Campbell Barton]

Revision: 27795
          http://projects.blender.org/plugins/scmsvn/viewcvs.php?view=rev&root=bf-blender&revision=27795
Author:   campbellbarton
Date:     2010-03-27 23:23:23 +0100 (Sat, 27 Mar 2010)

Log Message:
-----------
fix for writing out of buffer bounds when drawing to a buffer (most obvious with new grid type but could probably crash with stamp render option too)

Modified Paths:
--------------
    trunk/blender/source/blender/blenfont/intern/blf_font.c

Modified: trunk/blender/source/blender/blenfont/intern/blf_font.c
===================================================================
--- trunk/blender/source/blender/blenfont/intern/blf_font.c	2010-03-27 18:08:57 UTC (rev 27794)
+++ trunk/blender/source/blender/blenfont/intern/blf_font.c	2010-03-27 22:23:23 UTC (rev 27795)
@@ -150,8 +150,9 @@
 
 void blf_font_buffer(FontBLF *font, char *str)
 {
-	unsigned char *data, *cbuf;
+	unsigned char *cbuf;
 	unsigned int c;
+	unsigned char b_col_char[3];
 	GlyphBLF *g, *g_prev;
 	FT_Vector delta;
 	FT_UInt glyph_index;
@@ -159,14 +160,18 @@
 	int pen_x, pen_y, y, x, yb, diff;
 	int i, has_kerning, st, chx, chy;
 
-	if (!font->glyph_cache)
+	if (!font->glyph_cache || (!font->b_fbuf && !font->b_cbuf))
 		return;
-
+	
 	i= 0;
 	pen_x= (int)font->pos[0];
 	pen_y= (int)font->pos[1];
 	has_kerning= FT_HAS_KERNING(font->face);
 	g_prev= NULL;
+	
+	b_col_char[0]= font->b_col[0] * 255;
+	b_col_char[1]= font->b_col[1] * 255;
+	b_col_char[2]= font->b_col[2] * 255;
 
 	while (str[i]) {
 		c= blf_utf8_next((unsigned char *)str, &i);
@@ -216,15 +221,19 @@
 		else
 			chy= pen_y + ((int)g->pos_y);
 
-		if (font->b_fbuf) {
-			if (chx >= 0 && chx < font->bw && pen_y >= 0 && pen_y < font->bh) {
-				if (g->pitch < 0)
-					yb= 0;
-				else
-					yb= g->height-1;
+		if ((chx + g->width) >= 0 && chx < font->bw && (pen_y + g->height) >= 0 && pen_y < font->bh) {
+			/* dont draw beyond the buffer bounds */
+			int width_clip= g->width;
+			int height_clip= g->height;
 
-				for (y= 0; y < g->height; y++) {
-					for (x= 0; x < g->width; x++) {
+			if (width_clip + chx > font->bw)	width_clip  -= chx + width_clip - font->bw;
+			if (height_clip + pen_y > font->bh) height_clip -= pen_y + height_clip - font->bh;
+
+			yb= g->pitch < 0 ? 0 : g->height-1;
+			
+			if (font->b_fbuf) {
+				for (y= 0; y < height_clip; y++) {
+					for (x= 0; x < width_clip; x++) {
 						
 						a= *(g->bitmap + x + (yb * g->pitch)) / 255.0f;
 
@@ -249,22 +258,10 @@
 						yb--;
 				}
 			}
-		}
 
-		if (font->b_cbuf) {
-			if (chx >= 0 && chx < font->bw && pen_y >= 0 && pen_y < font->bh) {
-				char b_col_char[3];
-				b_col_char[0]= font->b_col[0] * 255;
-				b_col_char[1]= font->b_col[1] * 255;
-				b_col_char[2]= font->b_col[2] * 255;
-
-				if (g->pitch < 0)
-					yb= 0;
-				else
-					yb= g->height-1;
-
-				for (y= 0; y < g->height; y++) {
-					for (x= 0; x < g->width; x++) {
+			if (font->b_cbuf) {
+				for (y= 0; y < height_clip; y++) {
+					for (x= 0; x < width_clip; x++) {
 						a= *(g->bitmap + x + (yb * g->pitch)) / 255.0f;
 
 						if(a > 0.0f) {