From da8e87d6505fb33ed131144a33af88c6d0dc96fd Mon Sep 17 00:00:00 2001
From: Sadrul Habib Chowdhury <sadrul@users.sourceforge.net>
Date: Wed, 3 Mar 2010 11:18:55 -0500
Subject: Sanity check line numbers for non-negative value.

It looks like 'ys' can be negative at times, which results in invalid
memory reads, and possibly writes. Valgrind log from Friedrich Delgado
Friedrichs in savannah bug #29050.
---
 src/layer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/layer.c b/src/layer.c
index 88d7360..9c1fe34 100644
--- a/src/layer.c
+++ b/src/layer.c
@@ -1285,6 +1285,8 @@ int ys, ye;
 {
   if (!layer->l_pause.d)
     return;
+  if (ys < 0)
+    ys = 0;
   if (ye >= layer->l_height)
     ye = layer->l_height - 1;
   if (xe >= layer->l_width)
-- 
cgit v1.2.1