[cairo] [PATCH] spans: Fix the size of the span buffer for tor scan converter

[Taekyun Kim]

From: Taekyun Kim <tkq.kim at samsung.com>

X coordinate of a span can range between xmin and xmax. So we have
to allocate (xmax - xmin + 1) slots for spans.
---
 src/cairo-tor-scan-converter.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/cairo-tor-scan-converter.c b/src/cairo-tor-scan-converter.c
index b001bbd..de10f67 100644
--- a/src/cairo-tor-scan-converter.c
+++ b/src/cairo-tor-scan-converter.c
@@ -1428,12 +1428,15 @@ glitter_scan_converter_reset(
 			     int xmax, int ymax)
 {
     glitter_status_t status;
+    int max_num_spans;
 
     converter->xmin = 0; converter->xmax = 0;
     converter->ymin = 0; converter->ymax = 0;
 
-    if (xmax - xmin > ARRAY_LENGTH(converter->spans_embedded)) {
-	converter->spans = _cairo_malloc_ab (xmax - xmin,
+    max_num_spans = xmax - xmin - 1;
+
+    if (max_num_spans > ARRAY_LENGTH(converter->spans_embedded)) {
+	converter->spans = _cairo_malloc_ab (max_num_spans,
 					     sizeof (cairo_half_open_span_t));
 	if (unlikely (converter->spans == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
-- 
1.7.1