[Bug 29767] New: ellipse_first_quadrant() runs into dead loop for large width and height because of negative overflow

http://bugs.winehq.org/show_bug.cgi?id=29767

             Bug #: 29767
           Summary: ellipse_first_quadrant() runs into dead loop for large
                    width and height because of negative overflow
           Product: Wine
           Version: 1.4-rc1
          Platform: x86
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdi32
        AssignedTo: wine-bugs(a)winehq.org
        ReportedBy: jiashulu(a)gmail.com
    Classification: Unclassified


The ellipse_first_quadrant() function located in dlls/gdi32/dibdrv/graphics.c
is used to compute points of an ellipse. When provided large width and height
parameters, it will fall into dead loop and finally result in an access
violation exception.

To reproduce, just pass the following parameters to ellipse_first_quadrant(): 
width = 815, height = 815

The problem is that the following line will encounter negative overflow:
int dx  = 4 * b * b * (1 - a);
which makes the two if statement in the while loop to be false.

-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.

[Bug 29767] ellipse_first_quadrant() runs into dead loop for large width and height because of negative overflow

http://bugs.winehq.org/show_bug.cgi?id=29767

--- Comment #1 from jslu <jiashulu(a)gmail.com> 2012-02-02 01:48:04 CST ---
Created attachment 38653
  --> http://bugs.winehq.org/attachment.cgi?id=38653
A workaround that makes drawing 2048x2048 ellipse ok

-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.

[Bug 29767] ellipse_first_quadrant() runs into dead loop for large width and height because of negative overflow

http://bugs.winehq.org/show_bug.cgi?id=29767

Alexandre Julliard <julliard(a)winehq.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |c65de04789ee8c5bf1f6c9d869a
                   |                            |c53087af0fcee
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Alexandre Julliard <julliard(a)winehq.org> 2012-02-24 10:48:23 CST ---
Fixed by c65de04789ee8c5bf1f6c9d869ac53087af0fcee.

-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.

[Bug 29767] ellipse_first_quadrant() runs into dead loop for large width and height because of negative overflow

http://bugs.winehq.org/show_bug.cgi?id=29767

Alexandre Julliard <julliard(a)winehq.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Alexandre Julliard <julliard(a)winehq.org> 2012-02-24 12:49:13 CST ---
Closing bugs fixed in 1.4-rc5.

-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.