diff --git a/src/cairo-xcb-surface-render.c b/src/cairo-xcb-surface-render.c index 6f29224..efbf648 100644 --- a/src/cairo-xcb-surface-render.c +++ b/src/cairo-xcb-surface-render.c @@ -4514,7 +4514,6 @@ _composite_glyphs (void *closure, */ this_x = _cairo_lround (info->glyphs[i].d.x) - dst_x; this_y = _cairo_lround (info->glyphs[i].d.y) - dst_y; - assert (! (((this_x+4096) | (this_y+4096)) & ~0x3fffu)); this_glyphset_info = _cairo_xcb_scaled_glyph_get_glyphset_info (scaled_glyph); if (glyphset_info == NULL) @@ -4542,7 +4541,9 @@ _composite_glyphs (void *closure, * to the mask first, and then composes that to final surface, * though it's not a big deal. */ - if (request_size + width > max_request_size - _cairo_sz_x_glyph_elt_t || + if ((this_x - x) > INT16_MAX || (this_x - x) < INT16_MIN || + (this_y - y) > INT16_MAX || (this_y - y) < INT16_MIN || + request_size + width > max_request_size - _cairo_sz_x_glyph_elt_t || this_glyphset_info != glyphset_info) { status = _emit_glyphs_chunk (dst, op, src, diff --git a/src/cairo-xlib-surface.c b/src/cairo-xlib-surface.c index 6d593c0..11bcec7 100644 --- a/src/cairo-xlib-surface.c +++ b/src/cairo-xlib-surface.c @@ -4556,9 +4556,6 @@ _cairo_xlib_surface_emit_glyphs (cairo_xlib_display_t *display, * Update: upon seeing weird glyphs, we just return and let fallback * code do the job. */ - if (((this_x+4096)|(this_y+4096))&~0x3fffu) - break; - /* Send unsent glyphs to the server */ if (_cairo_xlib_scaled_glyph_get_glyphset_info (scaled_glyph) == NULL) { status = _cairo_xlib_surface_add_glyph (display, @@ -4606,7 +4603,9 @@ _cairo_xlib_surface_emit_glyphs (cairo_xlib_display_t *display, * to the mask first, and then composes that to final surface, * though it's not a big deal. */ - if (request_size + width > max_request_size - _cairo_sz_xGlyphElt || + if ((this_x - x) > INT16_MAX || (this_x - x) < INT16_MIN || + (this_y - y) > INT16_MAX || (this_y - y) < INT16_MIN || + request_size + width > max_request_size - _cairo_sz_xGlyphElt || (this_glyphset_info != glyphset_info)) { status = _emit_glyphs_chunk (display, dst, glyphs, i, scaled_font, op, src, attributes,