Bug 2690

Summary:

Crash in miFillPolygon() when doing miWideDash() and leftFace has dx == 0 and dy < 0

Product:

xorg

Reporter:

Egbert Eich <eich>

Component:

* Other

Assignee:

Egbert Eich <eich>

Status:

RESOLVED FIXED

QA Contact:

Severity:

normal

Priority:

high

CC:

keithp, roland.mainz, sndirsch

Version:

git

Hardware:

x86 (IA32)

OS:

Linux (All)

Whiteboard:

i915 platform:

i915 features:

Attachments:

Description	Flags
Fix	eich: 6.8-branch?

Description Egbert Eich 2005-03-10 02:30:33 UTC

miWideDash() may call miLineProjectingCap() which calculates the hight for
drawing when dx == 0 doing: topy = face->y; bottomy = face->y + dy; 
height = bottomy - topy; If face->dy < 0 this will result in a negative height.
miFillPolyHelper() will use this height to calculate the size of memory to be
allocated using this height which will cause the system to crash.

Comment 1 Egbert Eich 2005-03-10 02:32:33 UTC

Created attachment 2069 [details] [review]
Fix

Discussing this with Keith he came up with this fix.

Comment 2 Egbert Eich 2005-03-10 02:33:27 UTC

My Bug.

Comment 3 Roland Mainz 2005-03-11 06:11:39 UTC

Egbert:
Do you have a testcase (that may be a nice item for the xtest suite...) ?

Comment 4 Egbert Eich 2005-04-11 02:34:18 UTC

> Egbert:
. Do you have a testcase (that may be a nice item for the xtest suite...) ?
Yes I agree. But no I don't. My testcase was a recording of a client
communication which I replayed.

I've committed the patch now:
2005-04-11  Egbert Eich  <eich-at-freedesktop-dot-org>

        * programs/Xserver/mi/miwideline.c:
        Preventing hight for drawing from becoming negative when
        face->dy < 0. The height value is used in miFillPolyHelper()
        to calculate the size of memory to be allocated. A negative
        value will lead to a crash (Bugzilla #2690, Keith Packard,
        Egbert Eich).

Comment 5 Egbert Eich 2005-04-11 02:35:13 UTC

Fixed.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.