<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Image compositor can pass invalid coordinates to pixman_fill()"
href="https://bugs.freedesktop.org/show_bug.cgi?id=90120#c9">Comment # 9</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Image compositor can pass invalid coordinates to pixman_fill()"
href="https://bugs.freedesktop.org/show_bug.cgi?id=90120">bug 90120</a>
from <span class="vcard"><a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> <span class="fn">Chris Wilson</span></a>
</span></b>
<pre>(In reply to Federico Mena-Quintero from <a href="show_bug.cgi?id=90120#c8">comment #8</a>)
<span class="quote">> (In reply to Chris Wilson from <a href="show_bug.cgi?id=90120#c7">comment #7</a>)
> > Created <span class=""><a href="attachment.cgi?id=115240" name="attach_115240" title="Preliminary stroke validation">attachment 115240</a> <a href="attachment.cgi?id=115240&action=edit" title="Preliminary stroke validation">[details]</a></span> <a href='page.cgi?id=splinter.html&bug=90120&attachment=115240'>[review]</a> [review] [review]
> > Preliminary stroke validation
>
> This is really nice! It fixes the problem very cleanly - valgrind shows no
> problems with the fuzzed file.
>
> (And thanks for making me aware of CAIRO_STATUS_INVALID_SIZE; hopefully
> we'll have a lot more of it in the future :)</span >
If we start doing this, we should pick a new error status stg
CAIRO_STATUS_INVALID_RASTER_VALUE or perhaps
CAIRO_STATUS_INVALID_FIXEDPOINT_LINE_WIDTH or
CAIRO_STATUS_INVALID_RASTER_STROKE?
<span class="quote">> Chris, since you just put your foot into the rabbit hole :) May I interest
> you in another fixed-point overflow thing? This goes back to the old bugs
> #20091 and #39096. Using this fuzzed svg
>
> <svg>
> <defs>
> <clipPath id="clipper">
> <rect y="19" width="2" height="2" />
> <rect width="18446744073709551616" height="29" />
> </clipPath>
> </defs>
> <g clip-path="url(#clipper)">
> <g clip-path="url(#clipper)">
> </g>
> </g>
> </svg>
>
> with rsvg-view-3 and valigrind produces...</span >
The error is in the stage before not successfully generating a watertight
clipped polygon. It's one of those impossible conditions since it is only meant
to output pairs of edges, but the error you see later on is when you find an
edge with no pair.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>