andreacavalli
/
xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fb: reorder Bresenham error correction to avoid overshoot. 

When fbBresSolid draws a line, it can happen that after the last
pixel, the Bresenham error term overflows, and fbBresSolid paints
another pixel before adjusting the error term.

However, if this happens on the last pixel (len=0), this extra pixel
might overshoot the boundary, and, in rare cases, lead to a segfault.

Fix this issue by adjusting for the Bresenham error term before
drawing the main pixel, not after.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=24274
Signed-off-by: Simon Schubert <2@0x2c.or>
Tested-by: Mitch Davis <mjd+freedesktop.org@afork.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
Simon Schubert 2012-08-12 09:40:16 -07:00 committed by Keith Packard
parent c22c936b35
commit 863d528a9f
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
fb/fbseg.c
View File

@ -65,6 +65,12 @@ fbBresSolid(DrawablePtr pDrawable,
if (axis == X_AXIS) {
bits = 0;
while (len--) {
if (e >= 0) {
WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
bits = 0;
dst += dstStride;
e += e3;
}
bits |= mask;
mask = fbBresShiftMask(mask, signdx, dstBpp);
if (!mask) {
@ -74,21 +80,12 @@ fbBresSolid(DrawablePtr pDrawable,
mask = mask0;
}
e += e1;
if (e >= 0) {
WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits));
bits = 0;
dst += dstStride;
e += e3;
}
}
if (bits)
WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits));
}
else {
while (len--) {
WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask));
dst += dstStride;
e += e1;
if (e >= 0) {
e += e3;
mask = fbBresShiftMask(mask, signdx, dstBpp);
@ -97,6 +94,9 @@ fbBresSolid(DrawablePtr pDrawable,
mask = mask0;
}
}
WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask));
dst += dstStride;
e += e1;
}
}