From adac7011965ed75ea399b93dae917cb48180c77a Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.de>
Date: Mon, 11 Apr 2005 09:33:43 +0000
Subject: Preventing hight for drawing from becoming negative when face->dy <
 0. The     height value is used in miFillPolyHelper() to calculate the size
 of     memory to be allocated. A negative value will lead to a crash
 (Bugzilla     #2690, Keith Packard, Egbert Eich).

---
 mi/miwideline.c | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'mi')

diff --git a/mi/miwideline.c b/mi/miwideline.c
index 8888ca8bd..20bef031b 100644
--- a/mi/miwideline.c
+++ b/mi/miwideline.c
@@ -1168,6 +1168,10 @@ miLineProjectingCap (pDrawable, pGC, pixel, spanData, face, isLeft, xorg, yorg,
     }
     else if (dx == 0)
     {
+	if (dy < 0) {
+	    dy = -dy;
+	    isLeft = !isLeft;
+	}
 	topy = yorgi;
 	bottomy = yorgi + dy;
 	if (isLeft)
-- 
cgit v1.2.3