fb: make isClipped always reject negative coordinates (bug 11503)

A window with either dimension > 32767 can be positioned such that
coordinates > 32767 are visible on the screen. Attempts to draw to
those pixels will generate coordinates wrapped around to negative
values.

The optimized clipping macro, 'isClipped', in fbbits.h, computes
clipping in window space rather than screen space using int16 values,
and so it too has coordinates wrapped around to negative values and
hence ends up accepting the wrapped drawing coordinates.

Two possible fixes for this problem

 1) Detect wrapped region coordinates and clip those to 32767.
 2) Detect negative incoming coordinates and reject those

This patch takes the second approach as it is much shorter, simply
detecting when either X or Y incoming coordinate is negative, which
can never be 'within' any drawable.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>

fb/fbbits.h

@@ -25,7 +25,7 @@
  * underlying datatypes instead of masks
  */
 
-#define isClipped(c,ul,lr)  ((((c) - (ul)) | ((lr) - (c))) & 0x80008000)
+#define isClipped(c,ul,lr)  (((c) | ((c) - (ul)) | ((lr) - (c))) & 0x80008000)
 
 #ifdef HAVE_DIX_CONFIG_H
 #include <dix-config.h>