[PATCH 12/13] mi: Fill all spans for PolyFillArc at once

[Keith Packard]

Eric Anholt <eric at anholt.net> writes:

>> +    for (i = narcs, arc = parcs; --i >= 0; arc++)
>> +        nspans += arc->height;
>> +
>> +    pts = points = malloc (sizeof (DDXPointRec) * nspans + sizeof(int) * nspans);
>> +    if (!points)
>> +        return;
>> +    wids = widths = (int *) (points + nspans);
>
> Can you give me some justification of what prevents integer overflow
> here?

Argh. BigRequests strikes again. I was thinking that the max request size
would limit the number of arcs and keep this in check. Instead, a 16MB
request would contain 1398101 arcs. If each were the maximum possible
size (65536), then we'd try to allocation 91B spans. Will fix.

-- 
keith.packard at intel.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 810 bytes
Desc: not available
URL: <http://lists.x.org/archives/xorg-devel/attachments/20140507/60ee95fc/attachment.sig>