[Bug 29767] New: ellipse_first_quadrant() runs into dead loop for large width and height because of negative overflow

http://bugs.winehq.org/show_bug.cgi?id=29767

Bug #: 29767
           Summary: ellipse_first_quadrant() runs into dead loop for large
                    width and height because of negative overflow
           Product: Wine
           Version: 1.4-rc1
          Platform: x86
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdi32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
    Classification: Unclassified

The ellipse_first_quadrant() function located in dlls/gdi32/dibdrv/graphics.c
is used to compute points of an ellipse. When provided large width and height
parameters, it will fall into dead loop and finally result in an access
violation exception.

To reproduce, just pass the following parameters to ellipse_first_quadrant(): 
width = 815, height = 815

The problem is that the following line will encounter negative overflow:
int dx  = 4 * b * b * (1 - a);
which makes the two if statement in the while loop to be false.

[Bug 29767] ellipse_first_quadrant() runs into dead loop for large width and height because of negative overflow

http://bugs.winehq.org/show_bug.cgi?id=29767

--- Comment #1 from jslu  2012-02-02 01:48:04 CST ---
Created attachment 38653
  --> http://bugs.winehq.org/attachment.cgi?id=38653
A workaround that makes drawing 2048x2048 ellipse ok

[Bug 29767] ellipse_first_quadrant() runs into dead loop for large width and height because of negative overflow

http://bugs.winehq.org/show_bug.cgi?id=29767

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |c65de04789ee8c5bf1f6c9d869a
                   |                            |c53087af0fcee
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Alexandre Julliard  2012-02-24 10:48:23 CST ---
Fixed by c65de04789ee8c5bf1f6c9d869ac53087af0fcee.

[Bug 29767] ellipse_first_quadrant() runs into dead loop for large width and height because of negative overflow

http://bugs.winehq.org/show_bug.cgi?id=29767

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Alexandre Julliard  2012-02-24 12:49:13 CST ---
Closing bugs fixed in 1.4-rc5.