[Webkit-unassigned] [Bug 90777] New: SVG FEBlend filter multiply mode could overflow
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Jul 9 04:45:23 PDT 2012
https://bugs.webkit.org/show_bug.cgi?id=90777
Summary: SVG FEBlend filter multiply mode could overflow
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: SVG
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: rgabor at webkit.org
CC: zimmermann at kde.org
The FeBlend filter calculates with this formula in multiply mode:
return (((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA) / 255)
The problem is that the return type is unsigned char (0-255) but the calculated value could be more.
With the following values:
colorA = 255
colorB = 255
alphaA = 0
alphaB = 0
(((255 - 0) * 255 + (255 - 0 + 255) * 255) / 255) = 765
But because of the overflow the function returns with 253.
I think we should clamp it to 255 like this:
return std::min(((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA) / 255, 255)
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list