[Bf-blender-cvs] [8f29503] master: Fix T49893: Crash in Video Sequence Editor with 'drop' effect.

[Bastien Montagne]

Commit: 8f29503b523f243ae00db9a490927e628e4bdc91
Author: Bastien Montagne
Date:   Wed Dec 7 14:16:07 2016 +0100
Branches: master
https://developer.blender.org/rB8f29503b523f243ae00db9a490927e628e4bdc91

Fix T49893: Crash in Video Sequence Editor with 'drop' effect.

Code was not accounting for possibilities that width or height of given
buffers may be smaller than XOFF/YOFF...

Note that I seriously doubt that drop code actually works (as in, gives
expected results) when applied to tiles like it seems to be done
currently, but this is much more complex (and involved) topic.

===================================================================

M	source/blender/blenkernel/intern/seqeffects.c

===================================================================

diff --git a/source/blender/blenkernel/intern/seqeffects.c b/source/blender/blenkernel/intern/seqeffects.c
index ce7c520..802f0ff 100644
--- a/source/blender/blenkernel/intern/seqeffects.c
+++ b/source/blender/blenkernel/intern/seqeffects.c
@@ -1074,29 +1074,31 @@ static void do_sub_effect(const SeqRenderData *context, Sequence *UNUSED(seq), f
 
 static void do_drop_effect_byte(float facf0, float facf1, int x, int y, unsigned char *rect2i, unsigned char *rect1i, unsigned char *outi)
 {
-	int height, width, temp, fac, fac1, fac2;
+	int temp, fac, fac1, fac2;
 	unsigned char *rt1, *rt2, *out;
 	int field = 1;
 
-	width = x;
-	height = y;
+	const int width = x;
+	const int height = y;
+	const int xoff = min_ii(XOFF, width);
+	const int yoff = min_ii(YOFF, height);
 
 	fac1 = (int) (70.0f * facf0);
 	fac2 = (int) (70.0f * facf1);
 
-	rt2 = (unsigned char *) (rect2i + YOFF * width);
+	rt2 = (unsigned char *) (rect2i + yoff * width);
 	rt1 = (unsigned char *) rect1i;
 	out = (unsigned char *) outi;
-	for (y = 0; y < height - YOFF; y++) {
+	for (y = 0; y < height - yoff; y++) {
 		if (field) fac = fac1;
 		else fac = fac2;
 		field = !field;
 
-		memcpy(out, rt1, sizeof(int) * XOFF);
-		rt1 += XOFF * 4;
-		out += XOFF * 4;
+		memcpy(out, rt1, sizeof(int) * xoff);
+		rt1 += xoff * 4;
+		out += xoff * 4;
 
-		for (x = XOFF; x < width; x++) {
+		for (x = xoff; x < width; x++) {
 			temp = ((fac * rt2[3]) >> 8);
 
 			*(out++) = MAX2(0, *rt1 - temp); rt1++;
@@ -1105,37 +1107,38 @@ static void do_drop_effect_byte(float facf0, float facf1, int x, int y, unsigned
 			*(out++) = MAX2(0, *rt1 - temp); rt1++;
 			rt2 += 4;
 		}
-		rt2 += XOFF * 4;
+		rt2 += xoff * 4;
 	}
-	memcpy(out, rt1, sizeof(int) * YOFF * width);
+	memcpy(out, rt1, sizeof(int) * yoff * width);
 }
 
 static void do_drop_effect_float(float facf0, float facf1, int x, int y, float *rect2i, float *rect1i, float *outi)
 {
-	int height, width;
 	float temp, fac, fac1, fac2;
 	float *rt1, *rt2, *out;
 	int field = 1;
 
-	width = x;
-	height = y;
+	const int width = x;
+	const int height = y;
+	const int xoff = min_ii(XOFF, width);
+	const int yoff = min_ii(YOFF, height);
 
 	fac1 = 70.0f * facf0;
 	fac2 = 70.0f * facf1;
 
-	rt2 =  (rect2i + YOFF * width);
+	rt2 =  (rect2i + yoff * width);
 	rt1 =  rect1i;
 	out =  outi;
-	for (y = 0; y < height - YOFF; y++) {
+	for (y = 0; y < height - yoff; y++) {
 		if (field) fac = fac1;
 		else fac = fac2;
 		field = !field;
 
-		memcpy(out, rt1, 4 * sizeof(float) * XOFF);
-		rt1 += XOFF * 4;
-		out += XOFF * 4;
+		memcpy(out, rt1, 4 * sizeof(float) * xoff);
+		rt1 += xoff * 4;
+		out += xoff * 4;
 
-		for (x = XOFF; x < width; x++) {
+		for (x = xoff; x < width; x++) {
 			temp = fac * rt2[3];
 
 			*(out++) = MAX2(0.0f, *rt1 - temp); rt1++;
@@ -1144,9 +1147,9 @@ static void do_drop_effect_float(float facf0, float facf1, int x, int y, float *
 			*(out++) = MAX2(0.0f, *rt1 - temp); rt1++;
 			rt2 += 4;
 		}
-		rt2 += XOFF * 4;
+		rt2 += xoff * 4;
 	}
-	memcpy(out, rt1, 4 * sizeof(float) * YOFF * width);
+	memcpy(out, rt1, 4 * sizeof(float) * yoff * width);
 }
 
 /*********************** Mul *************************/