Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

b=360645, clamp the number of vertices for a pen to reasonable value, r=tor,a=jay/drivers

Browse Source 
git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_BRANCH@218571 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
vladimir%pobox.com
2007-01-18 00:37:06 +00:00
parent 85a2e22516
commit 5f8a38ba4b
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mozilla/gfx/cairo/cairo/src/cairo-pen.c
View File

@@ -63,7 +63,7 @@ _cairo_pen_init (cairo_pen_t *pen, double radius, cairo_gstate_t *gstate)
{
int i;
int reflect;
double det;
double det, major_axis;
if (pen->num_vertices) {
/* XXX: It would be nice to notice that the pen is already properly constructed.
@@ -75,6 +75,8 @@ _cairo_pen_init (cairo_pen_t *pen, double radius, cairo_gstate_t *gstate)
_cairo_pen_fini (pen);
}
double major_axis = _cairo_matrix_transformed_circle_major_axis(matrix, radius);
pen->radius = radius;
pen->tolerance = gstate->tolerance;
@@ -88,7 +90,11 @@ _cairo_pen_init (cairo_pen_t *pen, double radius, cairo_gstate_t *gstate)
pen->num_vertices = _cairo_pen_vertices_needed (gstate->tolerance,
radius,
&gstate->ctm);
if (pen->num_vertices > 0xffff) {
return CAIRO_STATUS_NO_MEMORY;
}
pen->vertices = malloc (pen->num_vertices * sizeof (cairo_pen_vertex_t));
if (pen->vertices == NULL) {
return CAIRO_STATUS_NO_MEMORY;