From b6b9d5aeffd5166dd9e5c4dc7e89c28c97c0b9d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Ekl=C3=B6f?= <daniel@ekloef.se>
Date: Mon, 9 Sep 2024 11:26:18 +0200
Subject: [PATCH] render: don't pass a negative radius to
 fill_rounded_rectangle()

If the border *size* is bigger than the border *radius*, we ended up
passing a negative radius to fill_rounded_rectangle().

Since the radius parameter in fill_rounded_rectangle() is an uint16_t,
we ended up passing a *very large* value, e.g. 65535. This resulted in
an integer overflow when calculating the number of pixman rectangles
to use, leading to a crash when calling
pixman_image_fill_rectangles().

diff --git a/render.c b/render.c
index 9f8106d..041c0c9 100644
--- a/render.c
+++ b/render.c
@@ -205,7 +205,7 @@ render_background(const struct render *render, struct buffer *buf)
             PIXMAN_OP_SRC, bg_img, &bg, brd_sz_scaled, brd_sz_scaled,
             w-(brd_sz_scaled*2),
             h-(brd_sz_scaled*2),
-            brd_rad_scaled - brd_sz_scaled);
+            max(brd_rad_scaled - brd_sz_scaled, 0));
 
         if (msaa_scale != 1){
             pixman_f_transform_t ftrans;