Bug 692299

Summary:	fz_round_rect doesn't correctly handle values > INT_MAX
Product:	MuPDF	Reporter:	zeniko
Component:	fitz	Assignee:	Tor Andersson <tor.andersson>
Status:	RESOLVED FIXED
Severity:	normal	CC:	robin.watts
Priority:	P4
Version:	unspecified
Hardware:	PC
OS:	Windows 7
URL:	http://code.google.com/p/sumatrapdf/issues/detail?id=1522
Customer:		Word Size:	---
Attachments:	minimal testcase

Description zeniko 2011-06-23 19:41:15 UTC

The document at http://ge.tt/9aYQnN5?c is missing the diagram when displayed at a zoom level above 88%. This is caused by

-2147483648 -2147483648 m
-2147483648 2147483647 l
2147483647 2147483647 l
2147483647 -2147483648 l
W* n

resulting in coordinate values above INT_MAX once stretched which are wrongly converted by ceilf into INT_MIN in fz_round_rect, causing everything to be clipped away.

Our fix: http://code.google.com/p/sumatrapdf/source/detail?r=3958

Comment 1 Tor Andersson 2011-08-29 21:16:54 UTC

I cannot reproduce the described behavior. Could this be caused by one of your other modifications?

Comment 2 zeniko 2011-08-30 16:48:08 UTC

Created attachment 7856 [details]
minimal testcase

Robin's recent clipping optimizations have fixed this issue except for pathological cases such as the attached testcase where the optimizations fail (a black square is expected at all zoom levels).

Comment 3 Robin Watts 2012-01-06 19:05:27 UTC

Fixed now in:


commit 6dd9108c5865c1ea2ab0e834f4ae85aa279bcca9
Author: Robin Watts <robin.watts@artifex.com>
Date:   Fri Jan 6 14:42:25 2012 +0000

    Various fixes to avoid arithmetic problems.

    Various fixes to avoid overflow problems, division by zeros, use
    of uninitialised variables etc. All from/suggested by Zenikos patch.


Thanks again!

Comment 4 zeniko 2012-12-25 16:15:04 UTC

I've just noted that this bug isn't completely fixed (or has regressed): Opening the attached testcase in MuPDF fails to render the square unless I zoom in or out. Apparently, there are some float values f for which (f > 0 && f < INT_MAX && (int)f < 0) holds...