Various fixes to avoid arithmetic problems.

Various fixes to avoid overflow problems, division by zeros, use
of uninitialised variables etc. All from/suggested by Zenikos patch.

2 files changed, 21 insertions, 13 deletions

diff --git a/fitz/base_geometry.c b/fitz/base_geometry.c
index 00a85c9b..4f9ef8b6 100644
--- a/fitz/base_geometry.c
+++ b/fitz/base_geometry.c
@@ -153,10 +153,16 @@ fz_bbox
 fz_round_rect(fz_rect f)
 {
 	fz_bbox i;
-	i.x0 = floorf(f.x0 + 0.001f); /* adjust by 0.001 to compensate for precision errors */
-	i.y0 = floorf(f.y0 + 0.001f);
-	i.x1 = ceilf(f.x1 - 0.001f);
-	i.y1 = ceilf(f.y1 - 0.001f);
+	/* adjust by 0.001 to compensate for precision errors */
+	f.x0 = floorf(f.x0 + 0.001f);
+	f.y0 = floorf(f.y0 + 0.001f);
+	f.x1 = ceilf(f.x1 - 0.001f);
+	f.y1 = ceilf(f.y1 - 0.001f);
+#define SAFE_INT(f) ((f > INT_MAX) ? INT_MAX : ((f < INT_MIN) ? INT_MIN : (int)f))
+	i.x0 = SAFE_INT(f.x0);
+	i.y0 = SAFE_INT(f.y0);
+	i.x1 = SAFE_INT(f.x1);
+	i.y1 = SAFE_INT(f.y1);
 	return i;
 }
 
diff --git a/fitz/res_path.c b/fitz/res_path.c
index bf61cff6..d8838899 100644
--- a/fitz/res_path.c
+++ b/fitz/res_path.c
@@ -147,17 +147,19 @@ fz_rect
 fz_bound_path(fz_path *path, fz_stroke_state *stroke, fz_matrix ctm)
 {
 	fz_point p;
-	fz_rect r = fz_empty_rect;
+	fz_rect r;
 	int i = 0;
 
-	if (path->len)
-	{
-		p.x = path->items[1].v;
-		p.y = path->items[2].v;
-		p = fz_transform_point(ctm, p);
-		r.x0 = r.x1 = p.x;
-		r.y0 = r.y1 = p.y;
-	}
+	/* If the path is empty, return the empty rectangle here - don't wait
+	 * for it to be expanded in the stroked case below. */
+	if (path->len == 0)
+		return fz_empty_rect;
+
+	p.x = path->items[1].v;
+	p.y = path->items[2].v;
+	p = fz_transform_point(ctm, p);
+	r.x0 = r.x1 = p.x;
+	r.y0 = r.y1 = p.y;
 
 	while (i < path->len)
 	{