[mapguide-commits] r9024 - in branches/2.6/MgDev: . Common/Renderers

[svn_mapguide at osgeo.org]

Author: jng
Date: 2016-08-23 05:42:46 -0700 (Tue, 23 Aug 2016)
New Revision: 9024

Modified:
   branches/2.6/MgDev/
   branches/2.6/MgDev/Common/Renderers/AGGRenderer.cpp
Log:
Merged revision(s) 9021 from trunk/MgDev:
Merged revision(s) 9019-9020 from sandbox/adsk/3.1n:
#2736: Server crash when layer contains complicate symbols https://trac.osgeo.org/mapguide/ticket/2736

It is a heap corruption defect. The issue is at line 1792~1814, Common\Renderers\AGGRenderer.cpp. There are minx and maxx which are double. Then we convert them to int. But in some special cases, the converted imaxx will be less than iminx. It results in some memory are corrupted in next operations. To fix the issue, we need to add a check for the values.
........
#2736: Server crash when layer contains complicate symbols https://trac.osgeo.org/mapguide/ticket/2736

Refine submission 9019.  
........

........



Property changes on: branches/2.6/MgDev
___________________________________________________________________
Modified: svn:mergeinfo
   - /branches/2.4/MgDev:6749-6756,6777-6783,6785-6787,6789,6791-6794,6796-6801,6954-6962,6986-7006
/branches/3.0/MgDev:8658,8958-8959
/sandbox/adsk/2.6l:8727
/sandbox/adsk/3.0m:8563,8584,8607,8625
/sandbox/adsk/3.1n:8871,8912,8921-8922,8942
/sandbox/jng/createruntimemap:7486-7555
/sandbox/jng/php56x:8975-8985
/sandbox/jng/rfc155:8874-8884
/sandbox/rfc94:5099-5163
/trunk/MgDev:8209-8210,8230,8313,8333,8359,8388,8392,8423,8433,8439,8443-8444,8518-8519,8567-8568,8571,8588-8589,8595,8616-8618,8626,8682,8728,8844,8956,8980,8996,9000,9004-9006
   + /branches/2.4/MgDev:6749-6756,6777-6783,6785-6787,6789,6791-6794,6796-6801,6954-6962,6986-7006
/branches/3.0/MgDev:8658,8958-8959
/sandbox/adsk/2.6l:8727
/sandbox/adsk/3.0m:8563,8584,8607,8625
/sandbox/adsk/3.1n:8871,8912,8921-8922,8942,9019-9020
/sandbox/jng/createruntimemap:7486-7555
/sandbox/jng/php56x:8975-8985
/sandbox/jng/rfc155:8874-8884
/sandbox/rfc94:5099-5163
/trunk/MgDev:8209-8210,8230,8313,8333,8359,8388,8392,8423,8433,8439,8443-8444,8518-8519,8567-8568,8571,8588-8589,8595,8616-8618,8626,8682,8728,8844,8956,8980,8996,9000,9004-9006,9021

Modified: branches/2.6/MgDev/Common/Renderers/AGGRenderer.cpp
===================================================================
--- branches/2.6/MgDev/Common/Renderers/AGGRenderer.cpp	2016-08-23 12:34:28 UTC (rev 9023)
+++ branches/2.6/MgDev/Common/Renderers/AGGRenderer.cpp	2016-08-23 12:42:46 UTC (rev 9024)
@@ -1806,9 +1806,12 @@
         // clear the affected region of the alpha mask
         agg::gray8 cc(0);
 
-        unsigned width = (int)imaxx - (int)iminx + 1;
-        for (int y=iminy; y<=imaxy; ++y)
-            c()->mask_pixf->copy_hline(iminx, y, width, cc);
+        if (imaxx >= iminx)
+        {        
+            unsigned width = (int)imaxx - (int)iminx + 1;
+            for (int y = iminy; y <= imaxy; ++y)
+                c()->mask_pixf->copy_hline(iminx, y, width, cc);
+        }
 
         // render the alpha mask polygon
         c()->mask_ren.color(agg::gray8(255));