From 8f51ea4657d872f75e1a6493aadcc769fd3b9324 Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Tue, 23 Sep 2008 23:19:02 +0100 Subject: [PATCH] [pattern] Beware unsigned wrap-around with pathological surface patterns. A surface pattern under an extreme transformation could lie entirely in the negative quadrant. This would trigger the fixup such that it's lower left corner was clamped to the origin, but the upper right corner was left unchecked. This could result in the width,height being negative and wrapping around to large values instead of being clamped to 0. --- src/cairo-pattern.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/cairo-pattern.c b/src/cairo-pattern.c index b6c40e3fb..60b1c2b14 100644 --- a/src/cairo-pattern.c +++ b/src/cairo-pattern.c @@ -1821,8 +1821,8 @@ _cairo_pattern_acquire_surface_for_surface (cairo_surface_pattern_t *pattern, */ x = MAX (0, floor (x1) - 1); y = MAX (0, floor (y1) - 1); - width = MIN (extents.width, ceil (x2) + 1) - x; - height = MIN (extents.height, ceil (y2) + 1) - y; + width = MAX (MIN (extents.width, ceil (x2) + 1) - x, 0); + height = MAX (MIN (extents.height, ceil (y2) + 1) - y, 0); } x += tx; y += ty;