Preventing hight for drawing from becoming negative when face->dy < 0. The
height value is used in miFillPolyHelper() to calculate the size of memory to be allocated. A negative value will lead to a crash (Bugzilla #2690, Keith Packard, Egbert Eich).
This commit is contained in:
parent
5e2080ef93
commit
adac701196
|
@ -1168,6 +1168,10 @@ miLineProjectingCap (pDrawable, pGC, pixel, spanData, face, isLeft, xorg, yorg,
|
||||||
}
|
}
|
||||||
else if (dx == 0)
|
else if (dx == 0)
|
||||||
{
|
{
|
||||||
|
if (dy < 0) {
|
||||||
|
dy = -dy;
|
||||||
|
isLeft = !isLeft;
|
||||||
|
}
|
||||||
topy = yorgi;
|
topy = yorgi;
|
||||||
bottomy = yorgi + dy;
|
bottomy = yorgi + dy;
|
||||||
if (isLeft)
|
if (isLeft)
|
||||||
|
|
Loading…
Reference in New Issue