diff options
author | Caolán McNamara <caolanm@redhat.com> | 2022-10-14 13:17:15 +0100 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2022-10-14 15:45:05 +0200 |
commit | f72cd57a3397088433df32baed5c1eb5210a6712 (patch) | |
tree | 63672649f90ff514ba14bb6f63ebdf44f1666b02 | |
parent | 8d4f64427528f76afa4bf39a23edaa991850a50a (diff) |
ofz#52353 Out-of-memory with ultrathick lines
Change-Id: Id907795a0e8f7646462edd510dfbc62ad2c26617
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141368
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
-rw-r--r-- | vcl/headless/CairoCommon.cxx | 24 |
1 files changed, 19 insertions, 5 deletions
diff --git a/vcl/headless/CairoCommon.cxx b/vcl/headless/CairoCommon.cxx index b0f93c1eaf41..11d4a9c0483a 100644 --- a/vcl/headless/CairoCommon.cxx +++ b/vcl/headless/CairoCommon.cxx @@ -708,12 +708,26 @@ bool CairoCommon::drawPolyLine(cairo_t* cr, basegfx::B2DRange* pExtents, const C cairo_set_line_join(cr, eCairoLineJoin); cairo_set_line_cap(cr, eCairoLineCap); constexpr int MaxNormalLineWidth = 128; - if (bObjectToDeviceIsIdentity && fLineWidth > MaxNormalLineWidth) + if (fLineWidth > MaxNormalLineWidth) { - SAL_WARN("vcl.gdi", "drawPolyLine, suspicious line width of: " << fLineWidth); - static const bool bFuzzing = utl::ConfigManager::IsFuzzing(); - if (bFuzzing) - fLineWidth = MaxNormalLineWidth; + const double fLineWidthPixel + = bObjectToDeviceIsIdentity + ? fLineWidth + : (rObjectToDevice * basegfx::B2DVector(fLineWidth, 0)).getLength(); + if (fLineWidthPixel > MaxNormalLineWidth) + { + SAL_WARN("vcl.gdi", "drawPolyLine, suspicious input line width of: " + << fLineWidth << ", will be " << fLineWidthPixel + << " pixels thick"); + static const bool bFuzzing = utl::ConfigManager::IsFuzzing(); + if (bFuzzing) + { + basegfx::B2DHomMatrix aObjectToDeviceInv(rObjectToDevice); + aObjectToDeviceInv.invert(); + fLineWidth + = (aObjectToDeviceInv * basegfx::B2DVector(MaxNormalLineWidth, 0)).getLength(); + } + } } cairo_set_line_width(cr, fLineWidth); cairo_set_miter_limit(cr, fMiterLimit); |