Bug 31093

Summary:

[PATCH] Integer overflow for dashed lines longer than 46340

Product:

xorg

Reporter:

Siddhesh Poyarekar <siddhesh.poyarekar>

Component:

Server/General

Assignee:

Xorg Project Team <xorg-team>

Status:

RESOLVED FIXED

QA Contact:

Xorg Project Team <xorg-team>

Severity:

normal

Priority:

medium

Keywords:

patch

Version:

git

Hardware:

Other

OS:

All

Whiteboard:

i915 platform:

i915 features:

Attachments:

Description	Flags
The patch	none
Test case	none

Description Siddhesh Poyarekar 2010-10-24 22:51:36 UTC

Created attachment 39752 [details] [review]
The patch

Lines of length greater than 46340 can be drawn with one of the
coordinates being negative. However with dashed lines, miPolyBuildPoly
overflows the int type when setting up edges for a section of the
dashed line. This fix casts the results into long long so that the 
numbers don't wrap around and result in the line not being drawn at
all.

Comment 1 Siddhesh Poyarekar 2010-10-24 22:59:27 UTC

Created attachment 39753 [details]
Test case

Compile with:

gcc -o line line.c -lX11

to see the dotted line and with:

gcc -DBREAK -o line line.c -lX11

The difference is that defining BREAK sets y2 to 31341 while otherwise it is set to 31341.

Comment 2 Alan Coopersmith 2010-10-24 22:59:58 UTC

Comment on attachment 39752 [details] [review]
The patch

Please submit patches to xorg-devel for review/applying:

http://www.x.org/wiki/Development/Documentation/SubmittingPatches

Comment 3 Siddhesh Poyarekar 2010-10-24 23:23:12 UTC

Thanks, done. The email is awaiting moderator approval since I am not subscribed to the list.

Comment 4 Jesse Adkins 2010-11-15 18:21:26 UTC

Fixed by git commit be7cf14c365c8ee0d69c4335e01316bcfcba69a4.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.