found out of bound write

image.c

@@ -116,21 +116,27 @@ void image_rotate (ImageRaw *img, int deg) {
 };
 
 
+void image_draw_pixel (ImageRaw *img, int x, int y, int col) {
+	if (img == NULL || img->data == NULL) return;
+	if (x < 0 || x >= img->w) return;
+	if (y < 0 || y >= img->h) return;
+
+	memcpy (img->data+3*(x+y*img->w), &col, 3);
+}
+
+
 void image_draw_rect (ImageRaw *img, Rect *r, int col) {
 	if (r == NULL || img == NULL || img->data == NULL) return;
 	if (r->x + r->w > img->w || r->y + r->h > img->h) return;
 	int x, y;
-	unsigned char pixel[3];
-
-	memcpy (pixel, &col, 3);
 
-	for (x = 0; x < r->w; x++) {
-		copypixel (img->data+3*(r->x+x+(r->y)*img->w), pixel);
-		copypixel (img->data+3*(r->x+x+(r->y+r->h)*img->w), pixel);
+	for (x = 0; x < r->w && x + r->x < img->w; x++) {
+		image_draw_pixel (img, x, r->y, col);
+		image_draw_pixel (img, x, r->y+r->h-1, col);
 	}
-	for (y = 0; y < r->h; y++) {
-		copypixel (img->data+3*(r->x+(r->y+y)*img->w), pixel);
-		copypixel (img->data+3*(r->x+r->w+(r->y+y)*img->w), pixel);
+	for (y = 0; y < r->h && y + r->y < img->h; y++) {
+		image_draw_pixel (img, r->x, y, col);
+		image_draw_pixel (img, r->x + r->w - 1, y, col);
 	}
 }
 

main.c

@@ -154,7 +154,9 @@ int main(int argc, char **argv) {
 	snprintf (fn, 3*LEN_FILENAME, "%s/%s-imgf-%03d.jpg", conf_debugout, outdate, conf_samples);
 	image_save(tmpimg, fn, 98);
 
+	printf ("detect level\n");
 	level = detect_level(imgf);
+	printf ("got %d\n", level);
 	tmpimg = image_copyF(imgf);
 	Rect r = {.x = 0,  .y = level, .w = 10, .h = 1};
 	image_draw_rect(tmpimg,  &r, 0x0000FF00);

vidoiltank.h

@@ -100,7 +100,7 @@ ImageRaw *image_alloc (int w, int h);
 void image_resize(ImageRaw *i, int w, int h);
 int image_save(ImageRaw *i, char *fn, int quality);
 void image_rotate (ImageRaw *img, int deg);
-
+void image_draw_pixel (ImageRaw *img, int x, int y, int col);
 void image_draw_rect (ImageRaw *img, Rect *r, int col);
 
 ImageFloat *imageF_alloc (int w, int h);