summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2022-10-14 13:17:15 +0100
committerCaolán McNamara <caolanm@redhat.com>2022-10-14 15:45:05 +0200
commitf72cd57a3397088433df32baed5c1eb5210a6712 (patch)
tree63672649f90ff514ba14bb6f63ebdf44f1666b02
parent8d4f64427528f76afa4bf39a23edaa991850a50a (diff)
ofz#52353 Out-of-memory with ultrathick lines
Change-Id: Id907795a0e8f7646462edd510dfbc62ad2c26617 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141368 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com>
-rw-r--r--vcl/headless/CairoCommon.cxx24
1 files changed, 19 insertions, 5 deletions
diff --git a/vcl/headless/CairoCommon.cxx b/vcl/headless/CairoCommon.cxx
index b0f93c1eaf41..11d4a9c0483a 100644
--- a/vcl/headless/CairoCommon.cxx
+++ b/vcl/headless/CairoCommon.cxx
@@ -708,12 +708,26 @@ bool CairoCommon::drawPolyLine(cairo_t* cr, basegfx::B2DRange* pExtents, const C
cairo_set_line_join(cr, eCairoLineJoin);
cairo_set_line_cap(cr, eCairoLineCap);
constexpr int MaxNormalLineWidth = 128;
- if (bObjectToDeviceIsIdentity && fLineWidth > MaxNormalLineWidth)
+ if (fLineWidth > MaxNormalLineWidth)
{
- SAL_WARN("vcl.gdi", "drawPolyLine, suspicious line width of: " << fLineWidth);
- static const bool bFuzzing = utl::ConfigManager::IsFuzzing();
- if (bFuzzing)
- fLineWidth = MaxNormalLineWidth;
+ const double fLineWidthPixel
+ = bObjectToDeviceIsIdentity
+ ? fLineWidth
+ : (rObjectToDevice * basegfx::B2DVector(fLineWidth, 0)).getLength();
+ if (fLineWidthPixel > MaxNormalLineWidth)
+ {
+ SAL_WARN("vcl.gdi", "drawPolyLine, suspicious input line width of: "
+ << fLineWidth << ", will be " << fLineWidthPixel
+ << " pixels thick");
+ static const bool bFuzzing = utl::ConfigManager::IsFuzzing();
+ if (bFuzzing)
+ {
+ basegfx::B2DHomMatrix aObjectToDeviceInv(rObjectToDevice);
+ aObjectToDeviceInv.invert();
+ fLineWidth
+ = (aObjectToDeviceInv * basegfx::B2DVector(MaxNormalLineWidth, 0)).getLength();
+ }
+ }
}
cairo_set_line_width(cr, fLineWidth);
cairo_set_miter_limit(cr, fMiterLimit);