diff options
author | Chris Wilson <chris@chris-wilson.co.uk> | 2011-10-12 14:26:08 +0100 |
---|---|---|
committer | Chris Wilson <chris@chris-wilson.co.uk> | 2011-10-12 14:26:08 +0100 |
commit | 5d1a17f354987140719f439c6c105c05c9510839 (patch) | |
tree | afc81bd1f0e8a6ffe0757021788e5f7ccbcbd29d | |
parent | 88a1b83177ecaf044a3425abc8faa571ca2b41f5 (diff) | |
download | cairo-5d1a17f354987140719f439c6c105c05c9510839.tar.gz |
mono: Silence valgrind by placing a sentinel value in the sorted buckets
If the edges finish before we complete the last scanline, we will
attempt to skip over the remaining lines using min_height of the
sentinel edge (MAX_INT). This causes us to read beyond the end of the
array of insertion buckets, unless we place a sentinel value in there to
break the loop.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-rw-r--r-- | src/cairo-mono-scan-converter.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/cairo-mono-scan-converter.c b/src/cairo-mono-scan-converter.c index 2d2eaac8e..a617f484d 100644 --- a/src/cairo-mono-scan-converter.c +++ b/src/cairo-mono-scan-converter.c @@ -119,7 +119,7 @@ floored_muldivrem(int x, int a, int b) static cairo_status_t polygon_init (struct polygon *polygon, int ymin, int ymax) { - unsigned h = ymax - ymin; + unsigned h = ymax - ymin + 1; polygon->y_buckets = polygon->y_buckets_embedded; if (h > ARRAY_LENGTH (polygon->y_buckets_embedded)) { @@ -128,6 +128,7 @@ polygon_init (struct polygon *polygon, int ymin, int ymax) return _cairo_error (CAIRO_STATUS_NO_MEMORY); } memset (polygon->y_buckets, 0, h * sizeof (struct edge *)); + polygon->y_buckets[h-1] = (void *)-1; polygon->ymin = ymin; polygon->ymax = ymax; |