[gs-cvs] rev 8882 - trunk/gs/src

[leonardo at ghostscript.com]

Author: leonardo
Date: 2008-07-27 09:01:28 -0700 (Sun, 27 Jul 2008)
New Revision: 8882

Modified:
   trunk/gs/src/gxclrast.c
   trunk/gs/src/gxclrect.c
Log:
Fix (clist) : Skip writing unuseful data with linear color triangle.

DETAILS :

This fixes a minor problem what was discovered while working on 
bug 689918 "Ghostscript 8.62 and 8.63 segmentation fault".

cmd_write_trapezoid_cmd wrote an unused data to clist when 
processing a linear color triangle. The variables ybot, ytop are never used
while a clist interpretation. In same time the data are not initialized
in that case, so they imply an indeterministic content and length of the clist. 

EXPECTED DIFFERENCES :

None.


Modified: trunk/gs/src/gxclrast.c
===================================================================
--- trunk/gs/src/gxclrast.c	2008-07-27 09:38:42 UTC (rev 8881)
+++ trunk/gs/src/gxclrast.c	2008-07-27 16:01:28 UTC (rev 8882)
@@ -1809,9 +1809,11 @@
 				cmd_getw(right.start.y, cbp);
 				cmd_getw(right.end.x, cbp);
 				cmd_getw(right.end.y, cbp);
-				cmd_getw(ybot, cbp);
-				cmd_getw(ytop, cbp);
 				cmd_getw(options, cbp);
+				if (!(options & 4)) {
+				    cmd_getw(ybot, cbp);
+				    cmd_getw(ytop, cbp);
+				}
 				swap_axes = options & 1;
 				wh = swap_axes ? tdev->width : tdev->height;
 				x0f = int2fixed(swap_axes ? y0 : x0);

Modified: trunk/gs/src/gxclrect.c
===================================================================
--- trunk/gs/src/gxclrect.c	2008-07-27 09:38:42 UTC (rev 8881)
+++ trunk/gs/src/gxclrect.c	2008-07-27 16:01:28 UTC (rev 8882)
@@ -173,8 +173,10 @@
 	       + cmd_sizew(left->end.x) + cmd_sizew(left->end.y)
 	       + cmd_sizew(right->start.x) + cmd_sizew(right->start.y)
 	       + cmd_sizew(right->end.x) + cmd_sizew(right->end.y)
-	       + cmd_sizew(ybot) + cmd_sizew(ytop) + cmd_sizew(options);
+	       + cmd_sizew(options);
 
+    if (!(options & 4))
+	rcsize += cmd_sizew(ybot) + cmd_sizew(ytop);
     if (options & 2) {
 	rcsize += cmd_sizew(fa->clip->p.x) + cmd_sizew(fa->clip->p.y) 
 		+ cmd_sizew(fa->clip->q.x) + cmd_sizew(fa->clip->q.y);
@@ -208,9 +210,11 @@
     cmd_putw(right->start.y, dp);
     cmd_putw(right->end.x, dp);
     cmd_putw(right->end.y, dp);
-    cmd_putw(ybot, dp);
-    cmd_putw(ytop, dp);
     cmd_putw(options, dp);
+    if (!(options & 4)) {
+	cmd_putw(ybot, dp);
+	cmd_putw(ytop, dp);
+    }
     if_debug6('L', "    t%d:%ld,%ld,%ld,%ld   %ld\n",
 	      rcsize - 1, left->start.x, left->start.y, left->end.x, left->end.y, ybot);
     if_debug6('L', "    t%ld,%ld,%ld,%ld   %ld   o=%d\n",
@@ -405,7 +409,7 @@
     right.end.x = right.end.y = 0; /* unused. */
 
     code = clist_write_fill_trapezoid(dev, &left, &right,
-	fa->ystart, fa->yend, fa->swap_axes | 2 | 4, NULL, fa->lop, fa, c0, c1, c2, NULL);
+	0, 0, fa->swap_axes | 2 | 4, NULL, fa->lop, fa, c0, c1, c2, NULL);
     if (code < 0)
 	return code;
     /* NOTE : The return value 0 for the fill_linear_color_triangle method means