From: Simon Schubert <[email protected]> When fbBresSolid draws a line, it can happen that after the last pixel, the Bresenham error term overflows, and fbBresSolid paints another pixel before adjusting the error term.
However, if this happens on the last pixel (len=0), this extra pixel might overshoot the boundary, and, in rare cases, lead to a segfault. Fix this issue by adjusting for the Bresenham error term before drawing the main pixel, not after. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=24274 Cc: Simon Schubert <[email protected]> Cc: Mitch Davis <[email protected]> Signed-off-by: Matt Turner <[email protected]> --- [mattst88] Rebased after indent. Simon, can I get your Signed-off-by? Mitch, can I get a Tested-by tag? fb/fbseg.c | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) diff --git a/fb/fbseg.c b/fb/fbseg.c index 0e4e0a9..1848387 100644 --- a/fb/fbseg.c +++ b/fb/fbseg.c @@ -65,6 +65,12 @@ fbBresSolid(DrawablePtr pDrawable, if (axis == X_AXIS) { bits = 0; while (len--) { + if (e >= 0) { + WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits)); + bits = 0; + dst += dstStride; + e += e3; + } bits |= mask; mask = fbBresShiftMask(mask, signdx, dstBpp); if (!mask) { @@ -74,21 +80,12 @@ fbBresSolid(DrawablePtr pDrawable, mask = mask0; } e += e1; - if (e >= 0) { - WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits)); - bits = 0; - dst += dstStride; - e += e3; - } } if (bits) WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits)); } else { while (len--) { - WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask)); - dst += dstStride; - e += e1; if (e >= 0) { e += e3; mask = fbBresShiftMask(mask, signdx, dstBpp); @@ -97,6 +94,9 @@ fbBresSolid(DrawablePtr pDrawable, mask = mask0; } } + WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask)); + dst += dstStride; + e += e1; } } -- 1.7.8.6 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
