From e9078e216d44b7b401250247be921ce51a2d69ea Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Fri, 10 Feb 2023 22:10:36 +0100 Subject: [PATCH] LibGfx: Make sure the Painter clip rect is never larger than the target The new Painter::set_clip_rect(IntRect) API was able to make the clip rect larger than the underlying target bitmap. This was not good, as it could make it possible to draw outside the bitmap memory. Fixes a crash when viewing https://twinings.co.uk/ in the browser. :^) --- Userland/Libraries/LibGfx/Painter.cpp | 5 +++++ Userland/Libraries/LibGfx/Painter.h | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/Userland/Libraries/LibGfx/Painter.cpp b/Userland/Libraries/LibGfx/Painter.cpp index faaa537292..44e2510c9c 100644 --- a/Userland/Libraries/LibGfx/Painter.cpp +++ b/Userland/Libraries/LibGfx/Painter.cpp @@ -2575,4 +2575,9 @@ void Painter::draw_scaled_bitmap_with_transform(IntRect const& dst_rect, Bitmap } } +void Painter::set_clip_rect(IntRect const& rect) +{ + state().clip_rect = rect.intersected(m_target->rect()); +} + } diff --git a/Userland/Libraries/LibGfx/Painter.h b/Userland/Libraries/LibGfx/Painter.h index 918ce51590..58c4d93f9c 100644 --- a/Userland/Libraries/LibGfx/Painter.h +++ b/Userland/Libraries/LibGfx/Painter.h @@ -177,7 +177,7 @@ public: } IntRect clip_rect() const { return state().clip_rect; } - void set_clip_rect(IntRect const& rect) { state().clip_rect = rect; } + void set_clip_rect(IntRect const&); int scale() const { return state().scale; }