From 5f8a38ba4ba225b79b830a853b42f7f398fc23aa Mon Sep 17 00:00:00 2001 From: "vladimir%pobox.com" Date: Thu, 18 Jan 2007 00:37:06 +0000 Subject: [PATCH] b=360645, clamp the number of vertices for a pen to reasonable value, r=tor,a=jay/drivers git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_BRANCH@218571 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/gfx/cairo/cairo/src/cairo-pen.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/mozilla/gfx/cairo/cairo/src/cairo-pen.c b/mozilla/gfx/cairo/cairo/src/cairo-pen.c index d1a3c6117be..db5a60b9faf 100644 --- a/mozilla/gfx/cairo/cairo/src/cairo-pen.c +++ b/mozilla/gfx/cairo/cairo/src/cairo-pen.c @@ -63,7 +63,7 @@ _cairo_pen_init (cairo_pen_t *pen, double radius, cairo_gstate_t *gstate) { int i; int reflect; - double det; + double det, major_axis; if (pen->num_vertices) { /* XXX: It would be nice to notice that the pen is already properly constructed. @@ -75,6 +75,8 @@ _cairo_pen_init (cairo_pen_t *pen, double radius, cairo_gstate_t *gstate) _cairo_pen_fini (pen); } + double major_axis = _cairo_matrix_transformed_circle_major_axis(matrix, radius); + pen->radius = radius; pen->tolerance = gstate->tolerance; @@ -88,7 +90,11 @@ _cairo_pen_init (cairo_pen_t *pen, double radius, cairo_gstate_t *gstate) pen->num_vertices = _cairo_pen_vertices_needed (gstate->tolerance, radius, &gstate->ctm); - + + if (pen->num_vertices > 0xffff) { + return CAIRO_STATUS_NO_MEMORY; + } + pen->vertices = malloc (pen->num_vertices * sizeof (cairo_pen_vertex_t)); if (pen->vertices == NULL) { return CAIRO_STATUS_NO_MEMORY;