From: Benjamin Otte <otte@redhat.com>
Date: Wed, 10 Nov 2021 16:26:13 +0000 (+0100)
Subject: css: Don't crash when color stop offsets descend
X-Git-Tag: archive/raspbian/4.6.5+ds-1+rpi1~1^2~19^2~5^2~151^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=46f8600b6a92f63fc34babff1b78d41b3b8301db;p=gtk4.git

css: Don't crash when color stop offsets descend

Testcase included.

Fixes #4424
---

diff --git a/gtk/gtkcssimageradial.c b/gtk/gtkcssimageradial.c
index 4b36a1e165..d43bf75173 100644
--- a/gtk/gtkcssimageradial.c
+++ b/gtk/gtkcssimageradial.c
@@ -178,7 +178,7 @@ gtk_css_image_radial_snapshot (GtkCssImage *image,
       else
         pos = MIN (1.0, _gtk_css_number_value_get (stop->offset, hradius) / hradius);
 
-      pos = MAX (pos, 0);
+      pos = MAX (pos, offset);
       step = (pos - offset) / (i - last);
       for (last = last + 1; last <= i; last++)
         {
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.css b/testsuite/reftests/css-radial-gradient-colorstop-crash.css
new file mode 100644
index 0000000000..bc64f2ed0e
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.css
@@ -0,0 +1,7 @@
+window {
+  background: red;
+}
+
+#test {
+  background: radial-gradient(circle, red 100%, blue 0%, red 100%);
+}
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui b/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui
new file mode 100644
index 0000000000..778a999b05
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <object class="GtkWindow">
+    <property name="width_request">10</property>
+    <property name="height_request">10</property>
+    <property name="decorated">0</property>
+  </object>
+</interface>
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.ui b/testsuite/reftests/css-radial-gradient-colorstop-crash.ui
new file mode 100644
index 0000000000..75379ada9f
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.ui
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <object class="GtkWindow">
+    <property name="name">test</property>
+    <property name="width_request">10</property>
+    <property name="height_request">10</property>
+    <property name="decorated">0</property>
+  </object>
+</interface>
diff --git a/testsuite/reftests/meson.build b/testsuite/reftests/meson.build
index 8ef810ae7d..f66ace543c 100644
--- a/testsuite/reftests/meson.build
+++ b/testsuite/reftests/meson.build
@@ -258,6 +258,9 @@ testdata = [
   'css-multi-state.css',
   'css-multi-state.ref.ui',
   'css-multi-state.ui',
+  'css-radial-gradient-colorstop-crash.css',
+  'css-radial-gradient-colorstop-crash.ref.ui',
+  'css-radial-gradient-colorstop-crash.ui',
   'data-url.css',
   'data-url.ref.ui',
   'data-url.ui',