[cairo-commit] src/cairo-mono-scan-converter.c

[Chris Wilson]

 src/cairo-mono-scan-converter.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 5d1a17f354987140719f439c6c105c05c9510839
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed Oct 12 14:26:08 2011 +0100

    mono: Silence valgrind by placing a sentinel value in the sorted buckets
    
    If the edges finish before we complete the last scanline, we will
    attempt to skip over the remaining lines using min_height of the
    sentinel edge (MAX_INT). This causes us to read beyond the end of the
    array of insertion buckets, unless we place a sentinel value in there to
    break the loop.
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/cairo-mono-scan-converter.c b/src/cairo-mono-scan-converter.c
index 2d2eaac..a617f48 100644
--- a/src/cairo-mono-scan-converter.c
+++ b/src/cairo-mono-scan-converter.c
@@ -119,7 +119,7 @@ floored_muldivrem(int x, int a, int b)
 static cairo_status_t
 polygon_init (struct polygon *polygon, int ymin, int ymax)
 {
-    unsigned h = ymax - ymin;
+    unsigned h = ymax - ymin + 1;
 
     polygon->y_buckets = polygon->y_buckets_embedded;
     if (h > ARRAY_LENGTH (polygon->y_buckets_embedded)) {
@@ -128,6 +128,7 @@ polygon_init (struct polygon *polygon, int ymin, int ymax)
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
     memset (polygon->y_buckets, 0, h * sizeof (struct edge *));
+    polygon->y_buckets[h-1] = (void *)-1;
 
     polygon->ymin = ymin;
     polygon->ymax = ymax;