From 1b94fd77792310c80b0a2bcf4bf6d4e4c4c23bca Mon Sep 17 00:00:00 2001
From: Alex Orange <crazycasta@gmail.com>
Date: Fri, 3 Oct 2014 15:41:38 -0600
Subject: [PATCH] fb: Fix Bresenham algorithms for commonly used small
 segments.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=54168

Fix errors introducted in 863d528a9f76d0e8f122aebf19f8564a4c67a938. Said
patch does indeed remove the problematic writes to bad memory, however
it also introduces errors in the algoritm. This patch has the effect of
reverting said patch and adding an if in the proper location to catch
the out of bounds memory write without causing problems to the overall
algorithm.

Signed-off-by: Alex Orange <crazycasta@gmail.com>
Reviewed-by: Peter Harris <pharris@opentext.com>
Tested-by: Peter Harris <pharris@opentext.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
---
 fb/fbseg.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/fb/fbseg.c b/fb/fbseg.c
index 36b17e376..c3c196ab4 100644
--- a/fb/fbseg.c
+++ b/fb/fbseg.c
@@ -65,12 +65,6 @@ fbBresSolid(DrawablePtr pDrawable,
     if (axis == X_AXIS) {
         bits = 0;
         while (len--) {
-            if (e >= 0) {
-                WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
-                bits = 0;
-                dst += dstStride;
-                e += e3;
-            }
             bits |= mask;
             mask = fbBresShiftMask(mask, signdx, dstBpp);
             if (!mask) {
@@ -80,12 +74,23 @@ fbBresSolid(DrawablePtr pDrawable,
                 mask = mask0;
             }
             e += e1;
+            if (e >= 0) {
+                if (bits) {
+                    WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
+                    bits = 0;
+                }
+                dst += dstStride;
+                e += e3;
+            }
         }
         if (bits)
             WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits));
     }
     else {
         while (len--) {
+            WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask));
+            dst += dstStride;
+            e += e1;
             if (e >= 0) {
                 e += e3;
                 mask = fbBresShiftMask(mask, signdx, dstBpp);
@@ -94,9 +99,6 @@ fbBresSolid(DrawablePtr pDrawable,
                     mask = mask0;
                 }
             }
-            WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask));
-            dst += dstStride;
-            e += e1;
         }
     }