test/trap-crasher.c: Add trapezoid that demonstrates a crash
authorSøren Sandmann Pedersen <ssp@redhat.com>
Wed, 23 Oct 2013 21:28:11 +0000 (17:28 -0400)
committerSøren Sandmann Pedersen <ssp@redhat.com>
Sat, 2 Nov 2013 00:24:27 +0000 (20:24 -0400)
This trapezoid causes a crash due to an underflow in the
pixman_trapezoid_valid().

Test case from Ritesh Khadgaray.

test/trap-crasher.c

index 4e4cac297f977c3ca30b5b420dcaca221bbd9ddd..77be1c98b487764fe6ced00094caab45cce25706 100644 (file)
@@ -5,7 +5,7 @@ int
 main()
 {
     pixman_image_t *dst;
-    pixman_trapezoid_t traps[1] = {
+    pixman_trapezoid_t traps[] = {
        {
            2147483646,
            2147483647,
@@ -18,6 +18,18 @@ main()
                { 0, 2147483647 }
            }
        },
+       {
+           32768,
+           - 2147483647,
+           {
+               { 0, 0 },
+               { 0, 2147483647 }
+           },
+           {
+               { 65536, 0 },
+               { 0, 2147483647 }
+           }
+       },
     };
 
     dst = pixman_image_create_bits (PIXMAN_a8, 1, 1, NULL, -1);