spans: Fix the size of the span buffer for tor scan converterspans

X coordinate of a span can range between xmin and xmax. So we have
to allocate (xmax - xmin + 1) slots for spans.

1 files changed, 5 insertions, 2 deletions

diff --git a/src/cairo-tor-scan-converter.c b/src/cairo-tor-scan-converter.c
index b001bbd6..d6ea7789 100644
--- a/src/cairo-tor-scan-converter.c
+++ b/src/cairo-tor-scan-converter.c
@@ -1428,12 +1428,15 @@ glitter_scan_converter_reset(
 			     int xmax, int ymax)
 {
     glitter_status_t status;
+    int max_num_spans;
 
     converter->xmin = 0; converter->xmax = 0;
     converter->ymin = 0; converter->ymax = 0;
 
-    if (xmax - xmin > ARRAY_LENGTH(converter->spans_embedded)) {
-	converter->spans = _cairo_malloc_ab (xmax - xmin,
+    max_num_spans = xmax - xmin + 1;
+
+    if (max_num_spans > ARRAY_LENGTH(converter->spans_embedded)) {
+	converter->spans = _cairo_malloc_ab (max_num_spans,
 					     sizeof (cairo_half_open_span_t));
 	if (unlikely (converter->spans == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);