From 0e4156121f05b14f800289ea34c5382de1f20869 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Thu, 23 Oct 2008 13:37:41 +0100
Subject: [PATCH] [rectangle] Fix unsigned promotion whilst computing
 intersect.

_cairo_rectangle_intersect() incorrectly allows unsigned promotion during
its arithmetic.
---
 src/cairo-rectangle.c | 31 +++++++++++++++++--------------
 src/cairoint.h        |  3 ++-
 2 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/src/cairo-rectangle.c b/src/cairo-rectangle.c
index 3618ba0b2..ec08db42e 100644
--- a/src/cairo-rectangle.c
+++ b/src/cairo-rectangle.c
@@ -96,29 +96,32 @@ _cairo_box_round_to_rectangle (const cairo_box_t     *box,
 }
 
 void
-_cairo_rectangle_intersect (cairo_rectangle_int_t *dest, cairo_rectangle_int_t *src)
+_cairo_rectangle_intersect (cairo_rectangle_int_t *dst,
+			    const cairo_rectangle_int_t *src)
 {
     int x1, y1, x2, y2;
 
-    x1 = MAX (dest->x, src->x);
-    y1 = MAX (dest->y, src->y);
-    x2 = MIN (dest->x + dest->width, src->x + src->width);
-    y2 = MIN (dest->y + dest->height, src->y + src->height);
+    x1 = MAX (dst->x, src->x);
+    y1 = MAX (dst->y, src->y);
+    /* Beware the unsigned promotion, fortunately we have bits to spare
+     * as (CAIRO_RECT_INT_MAX - CAIRO_RECT_INT_MIN) < UINT_MAX
+     */
+    x2 = MIN (dst->x + (int) dst->width,  src->x + (int) src->width);
+    y2 = MIN (dst->y + (int) dst->height, src->y + (int) src->height);
 
     if (x1 >= x2 || y1 >= y2) {
-	dest->x = 0;
-	dest->y = 0;
-	dest->width = 0;
-	dest->height = 0;
+	dst->x = 0;
+	dst->y = 0;
+	dst->width  = 0;
+	dst->height = 0;
     } else {
-	dest->x = x1;
-	dest->y = y1;
-	dest->width = x2 - x1;
-	dest->height = y2 - y1;
+	dst->x = x1;
+	dst->y = y1;
+	dst->width  = x2 - x1;
+	dst->height = y2 - y1;
     }
 }
 
-
 #define P1x (line->p1.x)
 #define P1y (line->p1.y)
 #define P2x (line->p2.x)
diff --git a/src/cairoint.h b/src/cairoint.h
index a00e6e123..5172b9e23 100644
--- a/src/cairoint.h
+++ b/src/cairoint.h
@@ -254,7 +254,8 @@ _cairo_box_round_to_rectangle (const cairo_box_t     *box,
 			       cairo_rectangle_int_t *rectangle);
 
 cairo_private void
-_cairo_rectangle_intersect (cairo_rectangle_int_t *dest, cairo_rectangle_int_t *src);
+_cairo_rectangle_intersect (cairo_rectangle_int_t *dst,
+			    const cairo_rectangle_int_t *src);
 
 cairo_private cairo_bool_t
 _cairo_box_intersects_line_segment (cairo_box_t *box, cairo_line_t *line);