[Cairo][PATCH] _mono_scan_converter_init() : Fix array size in Mono scan converter
SeongWon Cho <[email protected]>
| Newsgroups | gmane.comp.lib.cairo |
|---|---|
| Message-ID | <[email protected]> |
From d16f50507a96b714b726880ad49c9dbdccbe67f8 Mon Sep 17 00:00:00 2001 From: Seongwon Cho <[email protected] > Date: Wed, 29 Feb 2012 18:59:34 +0900 Subject: [PATCH] Array size should be fixed in Mono scan converter - Crash might be occurred - In tor scan converter same problem is fixed (e8dd13c8fa39c1e3118a4f197ee8865237be7e09) Reviewed-by: Zhigang Gong <[email protected] > --- src/cairo-mono-scan-converter.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/cairo-mono-scan-converter.c b/src/cairo-mono-scan-converter.c index a617f48..106f801 100644 --- a/src/cairo-mono-scan-converter.c +++ b/src/cairo-mono-scan-converter.c @@ -390,13 +390,15 @@ _mono_scan_converter_init(struct mono_scan_converter *c, int xmax, int ymax) { cairo_status_t status; + int max_num_spans; status = polygon_init (c->polygon, ymin, ymax); if (unlikely (status)) return status; - if (xmax - xmin > ARRAY_LENGTH(c->spans_embedded)) { - c->spans = _cairo_malloc_ab (xmax - xmin, + max_num_spans = xmax - xmin + 1; + if (max_num_spans > ARRAY_LENGTH(c->spans_embedded)) { + c->spans = _cairo_malloc_ab (max_num_spans, sizeof (cairo_half_open_span_t)); if (unlikely (c->spans == NULL)) { polygon_fini (c->polygon); -- 1.7.5.4 -- cairo mailing list [email protected] http://lists.cairographics.org/mailman/listinfo/cairo