Olivier Fourdan <ofour...@redhat.com> writes:

> @@ -722,11 +723,11 @@ glamor_compute_transform_clipped_regions(PixmapPtr 
> pixmap,
>          temp_box.x2 = MIN(temp_box.x2, pixmap->drawable.width);
>          temp_box.y2 = MIN(temp_box.y2, pixmap->drawable.height);
>      }
> -    /* Now copy back the box32 to a box16 box. */
> -    short_box.x1 = temp_box.x1;
> -    short_box.y1 = temp_box.y1;
> -    short_box.x2 = temp_box.x2;
> -    short_box.y2 = temp_box.y2;
> +    /* Now copy back the box32 to a box16 box, avoiding overflow. */
> +    short_box.x1 = MIN(temp_box.x1, INT16_MAX);
> +    short_box.y1 = MIN(temp_box.y1, INT16_MAX);
> +    short_box.x2 = MIN(temp_box.x2, INT16_MAX);
> +    short_box.y2 = MIN(temp_box.y2, INT16_MAX);

temp_box.y2 and temp_box.x2 are already clipped to the pixmap size, and
the server should be limiting those to INT16_MAX. Is that not true for
this case somehow?

-- 
-keith

Attachment: signature.asc
Description: PGP signature

_______________________________________________
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: https://lists.x.org/mailman/listinfo/xorg-devel

Reply via email to