[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-commits
Subject:    koffice/krita
From:       Dmitry Kazakov <dimula73 () gmail ! com>
Date:       2010-09-25 14:59:17
Message-ID: 20100925145917.57A33AC857 () svn ! kde ! org
[Download RAW message or body]

SVN commit 1179461 by dkazakov:

Fixed a bug in KisPerChannelFilter

We used to call data() method for a temporary QVector object. This
object would be removed right after making a deep copy of the source
vector. This led to reading free'd memory.

BUG:251624


 M  +2 -2      image/kis_cubic_curve.cpp  
 M  +2 -2      image/kis_cubic_curve.h  
 M  +2 -3      plugins/filters/colorsfilters/kis_perchannel_filter.cpp  


--- trunk/koffice/krita/image/kis_cubic_curve.cpp #1179460:1179461
@@ -426,13 +426,13 @@
     setPoints(points);
 }
 
-QVector<quint16> KisCubicCurve::uint16Transfer(int size) const
+const QVector<quint16>& KisCubicCurve::uint16Transfer(int size) const
 {
     d->data->updateTransfer<quint16, int>(&d->data->u16Transfer, d->data->validU16Transfer, 0x0, 0xFFFF, size);
     return d->data->u16Transfer;
 }
 
-QVector<qreal> KisCubicCurve::floatTransfer(int size) const
+const QVector<qreal>& KisCubicCurve::floatTransfer(int size) const
 {
     d->data->updateTransfer<qreal, qreal>(&d->data->fTransfer, d->data->validFTransfer, 0.0, 1.0, size);
     return d->data->fTransfer;
--- trunk/koffice/krita/image/kis_cubic_curve.h #1179460:1179461
@@ -54,8 +54,8 @@
     int addPoint(const QPointF& point);
     void removePoint(int idx);
 public:
-    QVector<quint16> uint16Transfer(int size = 256) const;
-    QVector<qreal> floatTransfer(int size = 256) const;
+    const QVector<quint16>& uint16Transfer(int size = 256) const;
+    const QVector<qreal>& floatTransfer(int size = 256) const;
 public:
     QString toString() const;
     void fromString(const QString&);
--- trunk/koffice/krita/plugins/filters/colorsfilters/kis_perchannel_filter.cpp #1179460:1179461
@@ -408,9 +408,8 @@
     }
 
     const quint16** transfers = new const quint16*[configBC->m_curves.size()];
-    for(int i = 0; i < configBC->m_curves.size(); ++i)
-    {
-        transfers[i] = configBC->m_curves[i].uint16Transfer().data();
+    for(int i = 0; i < configBC->m_curves.size(); ++i) {
+        transfers[i] = configBC->m_curves[i].uint16Transfer().constData();
     }
     KoColorTransformation* t = cs->createPerChannelAdjustment(transfers);
     delete transfers;
[prev in list] [next in list] [prev in thread] [next in thread]