fix(refr): fix memory write out of bounds issue

demos/music/lv_demo_music_main.c

@@ -62,6 +62,7 @@ static void timer_cb(lv_timer_t * t);
 static void track_load(uint32_t id);
 static void stop_start_anim(lv_timer_t * t);
 static void spectrum_end_cb(lv_anim_t * a);
+static void album_fade_anim_cb(void * var, int32_t v);
 static int32_t get_cos(int32_t deg, int32_t a);
 static int32_t get_sin(int32_t deg, int32_t a);
 
@@ -667,9 +668,14 @@ static void track_load(uint32_t id)
     lv_label_set_text(artist_label, _lv_demo_music_get_artist(track_id));
     lv_label_set_text(genre_label, _lv_demo_music_get_genre(track_id));
 
-    lv_obj_fade_out(album_img_obj, 500, 0);
-
     lv_anim_t a;
+    lv_anim_init(&a);
+    lv_anim_set_var(&a, album_img_obj);
+    lv_anim_set_values(&a, lv_obj_get_style_img_opa(album_img_obj, 0), LV_OPA_TRANSP);
+    lv_anim_set_exec_cb(&a, album_fade_anim_cb);
+    lv_anim_set_time(&a, 500);
+    lv_anim_start(&a);
+
     lv_anim_init(&a);
     lv_anim_set_var(&a, album_img_obj);
     lv_anim_set_time(&a, 500);
@@ -702,7 +708,6 @@ static void track_load(uint32_t id)
     lv_anim_start(&a);
 
     album_img_obj = album_img_create(spectrum_obj);
-    lv_obj_fade_in(album_img_obj, 500, 100);
 
     lv_anim_set_path_cb(&a, lv_anim_path_overshoot);
     lv_anim_set_var(&a, album_img_obj);
@@ -712,6 +717,14 @@ static void track_load(uint32_t id)
     lv_anim_set_exec_cb(&a, _img_set_zoom_anim_cb);
     lv_anim_set_ready_cb(&a, NULL);
     lv_anim_start(&a);
+
+    lv_anim_init(&a);
+    lv_anim_set_var(&a, album_img_obj);
+    lv_anim_set_values(&a, 0, LV_OPA_COVER);
+    lv_anim_set_exec_cb(&a, album_fade_anim_cb);
+    lv_anim_set_time(&a, 500);
+    lv_anim_set_delay(&a, 100);
+    lv_anim_start(&a);
 }
 
 int32_t get_cos(int32_t deg, int32_t a)
@@ -983,5 +996,10 @@ static void stop_start_anim(lv_timer_t * t)
     start_anim = false;
     lv_obj_refresh_ext_draw_size(spectrum_obj);
 }
+
+static void album_fade_anim_cb(void * var, int32_t v)
+{
+    lv_obj_set_style_img_opa(var, v, 0);
+}
 #endif /*LV_USE_DEMO_MUSIC*/
 

src/core/lv_refr.c

@@ -438,9 +438,9 @@ void _lv_disp_refr_timer(lv_timer_t * tmr)
         uint32_t max_kb_tenth = (max_size - (max_kb * 1024)) / 102;
         lv_label_set_text_fmt(mem_label,
                               "%"LV_PRIu32 ".%"LV_PRIu32 " kB used (%d %%)\n"
-                              "%"LV_PRIu32 ".%"LV_PRIu32 " kB max, %d%% frag.",
+                              "%d%% frag.",
                               used_kb, used_kb_tenth, mon.used_pct,
-                              max_kb, max_kb_tenth, mon.frag_pct);
+                              mon.frag_pct);
     }
 #endif
 
@@ -958,7 +958,7 @@ void refr_obj(lv_draw_ctx_t * draw_ctx, lv_obj_t * obj)
             if((flags & LV_DRAW_LAYER_FLAG_CAN_SUBDIVIDE) == 0) break;
 
             layer_ctx->area_act.y1 = layer_ctx->area_act.y2 + 1;
-            layer_ctx->area_act.y2 += layer_ctx->area_act.y1 + layer_ctx->max_row_with_no_alpha;
+            layer_ctx->area_act.y2 = layer_ctx->area_act.y1 + layer_ctx->max_row_with_no_alpha - 1;
         }
 
         lv_draw_layer_destroy(draw_ctx, layer_ctx);

src/draw/sw/lv_draw_sw_rect.c

@@ -128,7 +128,6 @@ static void draw_bg(lv_draw_ctx_t * draw_ctx, const lv_draw_rect_dsc_t * dsc, co
     if(!mask_any && dsc->radius == 0 && (grad_dir == LV_GRAD_DIR_NONE)) {
         blend_dsc.blend_area = &bg_coords;
         blend_dsc.opa = dsc->bg_opa;
-
         lv_draw_sw_blend(draw_ctx, &blend_dsc);
         return;
     }