[Bug 2690] New: Crash in miFillPolygon() when doing miWideDash() and leftFace has dx == 0 and dy < 0

[bugzilla-daemon at freedesktop.org]

Please do not reply to this email: if you want to comment on the bug, go to    
       
the URL shown below and enter yourcomments there.     
   
https://bugs.freedesktop.org/show_bug.cgi?id=2690          
     
           Summary: Crash in miFillPolygon() when doing miWideDash() and
                    leftFace has dx == 0 and dy < 0
           Product: xorg
           Version: CVS_head
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: * Other
        AssignedTo: xorg-bugzilla-noise at freedesktop.org
        ReportedBy: eich at pdx.freedesktop.org
                CC: keithp at keithp.com,sndirsch at suse.de


miWideDash() may call miLineProjectingCap() which calculates the hight for
drawing when dx == 0 doing: topy = face->y; bottomy = face->y + dy; 
height = bottomy - topy; If face->dy < 0 this will result in a negative height.
miFillPolyHelper() will use this height to calculate the size of memory to be
allocated using this height which will cause the system to crash.          
     
     
--           
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email         
     
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.