summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSiddhesh Poyarekar <siddhesh.poyarekar@gmail.com>2010-10-26 09:11:53 +0530
committerJeremy Huddleston <jeremyhu@apple.com>2010-11-13 15:16:26 -0800
commit8452392c4bffd424458a82a381ea2496e6556e7e (patch)
tree6d9f10b71371b699feda1943f760fae175520651
parentb4bb374cc356be0a416f1d7f52dbb2adb6e512d3 (diff)
mi: Integer overflow for dashed lines longer than 46340. #31093
Lines of length greater than 46340 can be drawn with one of the coordinates being negative. However for dashed lines, miPolyBuildPoly overflows the int type when setting up edges for a section of the dashed line. This results in the dashed segments not being drawn at all. Signed-off-by: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com> (cherry picked from commit be7cf14c365c8ee0d69c4335e01316bcfcba69a4)
-rw-r--r--mi/miwideline.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/mi/miwideline.c b/mi/miwideline.c
index b11b40bd2..bc5ee74c2 100644
--- a/mi/miwideline.c
+++ b/mi/miwideline.c
@@ -403,7 +403,7 @@ miPolyBuildPoly (
i = top;
j = StepAround (top, -1, count);
- if (slopes[j].dy * slopes[i].dx > slopes[i].dy * slopes[j].dx)
+ if ((int64_t)slopes[j].dy * slopes[i].dx > (int64_t)slopes[i].dy * slopes[j].dx)
{
clockwise = -1;
slopeoff = -1;