summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSøren Sandmann Pedersen <ssp@redhat.com>2011-12-22 16:37:26 (GMT)
committerSøren Sandmann Pedersen <ssp@redhat.com>2012-01-18 20:37:08 (GMT)
commitee500cb2b1abf04ba40a8abfe358f6211d6078d1 (patch)
treeb85f27c55f12d39398864bd9752294d0832de749
parent1398a2fae4ba63f824049507a3d87a09c0af9af2 (diff)
downloadpixman-ee500cb2b1abf04ba40a8abfe358f6211d6078d1.tar.gz
pixman-ee500cb2b1abf04ba40a8abfe358f6211d6078d1.tar.xz
Reject trapezoids where top (botttom) is above (below) the edges
When a trapezoid has a top/bottom that is above/below the left/right edges, degenerate trapezoids become possible. For example the edge could be very short and close to horizontal. If the bottom edge is far below the bottom point of such a short edge, the result is that the lower right corner of the trapezoid will be extremely far to the left. This kind of trapezoid causes overflows in the rasterization code, so change pixman_trapezoid_valid() to reject them.
-rw-r--r--pixman/pixman.h12
-rw-r--r--test/composite-traps-test.c2
2 files changed, 9 insertions, 5 deletions
diff --git a/pixman/pixman.h b/pixman/pixman.h
index c57092a..ab04103 100644
--- a/pixman/pixman.h
+++ b/pixman/pixman.h
@@ -906,10 +906,14 @@ struct pixman_triangle
};
/* whether 't' is a well defined not obviously empty trapezoid */
-#define pixman_trapezoid_valid(t) \
- ((t)->left.p1.y != (t)->left.p2.y && \
- (t)->right.p1.y != (t)->right.p2.y && \
- (int) ((t)->bottom - (t)->top) > 0)
+#define pixman_trapezoid_valid(t) \
+ ((t)->left.p1.y != (t)->left.p2.y && \
+ (t)->right.p1.y != (t)->right.p2.y && \
+ (int) ((t)->bottom - (t)->top) > 0 && \
+ (t)->bottom <= (t)->left.p2.y && \
+ (t)->bottom <= (t)->right.p2.y && \
+ (t)->top >= (t)->left.p1.y && \
+ (t)->top >= (t)->right.p1.y)
struct pixman_span_fix
{
diff --git a/test/composite-traps-test.c b/test/composite-traps-test.c
index fa6d8a9..60affe3 100644
--- a/test/composite-traps-test.c
+++ b/test/composite-traps-test.c
@@ -252,6 +252,6 @@ test_composite (int testnum,
int
main (int argc, const char *argv[])
{
- return fuzzer_test_main("composite traps", 40000, 0xE3112106,
+ return fuzzer_test_main("composite traps", 40000, 0x4346479C,
test_composite, argc, argv);
}