From db258a27f021c80281ed4f89df897dfda0ffce9f Mon Sep 17 00:00:00 2001 From: Maarten Lankhorst Date: Wed, 2 Oct 2013 15:47:54 +0200 Subject: [PATCH] exa: only draw valid trapezoids Fixes freedesktop.org bug https://bugs.freedesktop.org/show_bug.cgi?id=67484 If t->bottom is close to MIN_INT, removing top can wraparound, so do the check properly. A similar fix should also be applied to pixman. Signed-off-by: Maarten Lankhorst Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede (cherry picked from commit c6511d0142040654140bdedd6f03d43af0abba21) --- exa/exa_render.c | 3 ++- render/picture.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/exa/exa_render.c b/exa/exa_render.c index fc3ddea79..b24bec052 100644 --- a/exa/exa_render.c +++ b/exa/exa_render.c @@ -1141,7 +1141,8 @@ exaTrapezoids(CARD8 op, PicturePtr pSrc, PicturePtr pDst, exaPrepareAccess(pPicture->pDrawable, EXA_PREPARE_DEST); for (; ntrap; ntrap--, traps++) - (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1, -bounds.y1); + if (xTrapezoidValid(traps)) + (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1, -bounds.y1); exaFinishAccess(pPicture->pDrawable, EXA_PREPARE_DEST); xRel = bounds.x1 + xSrc - xDst; diff --git a/render/picture.h b/render/picture.h index 087e54d7a..4499a0021 100644 --- a/render/picture.h +++ b/render/picture.h @@ -211,7 +211,7 @@ typedef pixman_fixed_t xFixed; /* whether 't' is a well defined not obviously empty trapezoid */ #define xTrapezoidValid(t) ((t)->left.p1.y != (t)->left.p2.y && \ (t)->right.p1.y != (t)->right.p2.y && \ - (int) ((t)->bottom - (t)->top) > 0) + ((t)->bottom > (t)->top)) /* * Standard NTSC luminance conversions: