29 lines
1.1 KiB
Diff
29 lines
1.1 KiB
Diff
From b6b9d5aeffd5166dd9e5c4dc7e89c28c97c0b9d8 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Daniel=20Ekl=C3=B6f?= <daniel@ekloef.se>
|
|
Date: Mon, 9 Sep 2024 11:26:18 +0200
|
|
Subject: [PATCH] render: don't pass a negative radius to
|
|
fill_rounded_rectangle()
|
|
|
|
If the border *size* is bigger than the border *radius*, we ended up
|
|
passing a negative radius to fill_rounded_rectangle().
|
|
|
|
Since the radius parameter in fill_rounded_rectangle() is an uint16_t,
|
|
we ended up passing a *very large* value, e.g. 65535. This resulted in
|
|
an integer overflow when calculating the number of pixman rectangles
|
|
to use, leading to a crash when calling
|
|
pixman_image_fill_rectangles().
|
|
|
|
diff --git a/render.c b/render.c
|
|
index 9f8106d..041c0c9 100644
|
|
--- a/render.c
|
|
+++ b/render.c
|
|
@@ -205,7 +205,7 @@ render_background(const struct render *render, struct buffer *buf)
|
|
PIXMAN_OP_SRC, bg_img, &bg, brd_sz_scaled, brd_sz_scaled,
|
|
w-(brd_sz_scaled*2),
|
|
h-(brd_sz_scaled*2),
|
|
- brd_rad_scaled - brd_sz_scaled);
|
|
+ max(brd_rad_scaled - brd_sz_scaled, 0));
|
|
|
|
if (msaa_scale != 1){
|
|
pixman_f_transform_t ftrans;
|