b662779
From patchwork Wed Oct  2 13:47:54 2013
b662779
Content-Type: text/plain; charset="utf-8"
b662779
MIME-Version: 1.0
b662779
Content-Transfer-Encoding: 7bit
b662779
Subject: exa: only draw valid trapezoids
b662779
From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
b662779
X-Patchwork-Id: 14769
b662779
Message-Id: <524C240A.9010607@canonical.com>
b662779
To: "X.Org Devel List" <xorg-devel@lists.freedesktop.org>
b662779
Date: Wed, 02 Oct 2013 15:47:54 +0200
b662779
b662779
Fixes freedesktop.org bug https://bugs.freedesktop.org/show_bug.cgi?id=67484
b662779
b662779
If t->bottom is close to MIN_INT, removing top can wraparound, so do the check properly.
b662779
A similar fix should also be applied to pixman.
b662779
b662779
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
b662779
b662779
---
b662779
b662779
b662779
diff --git a/exa/exa_render.c b/exa/exa_render.c
b662779
index 172e2b5..807eeba 100644
b662779
--- a/exa/exa_render.c
b662779
+++ b/exa/exa_render.c
b662779
@@ -1141,7 +1141,8 @@ exaTrapezoids(CARD8 op, PicturePtr pSrc, PicturePtr pDst,
b662779
 
b662779
         exaPrepareAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
b662779
         for (; ntrap; ntrap--, traps++)
b662779
-            (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1, -bounds.y1);
b662779
+            if (xTrapezoidValid(traps))
b662779
+                (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1, -bounds.y1);
b662779
         exaFinishAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
b662779
 
b662779
         xRel = bounds.x1 + xSrc - xDst;
b662779
diff --git a/render/picture.h b/render/picture.h
b662779
index c85353a..fcd6401 100644
b662779
--- a/render/picture.h
b662779
+++ b/render/picture.h
b662779
@@ -211,7 +211,7 @@ typedef pixman_fixed_t xFixed;
b662779
 /* whether 't' is a well defined not obviously empty trapezoid */
b662779
 #define xTrapezoidValid(t)  ((t)->left.p1.y != (t)->left.p2.y && \
b662779
 			     (t)->right.p1.y != (t)->right.p2.y && \
b662779
-			     (int) ((t)->bottom - (t)->top) > 0)
b662779
+			     ((t)->bottom > (t)->top))
b662779
 
b662779
 /*
b662779
  * Standard NTSC luminance conversions: