mono: Silence valgrind by placing a sentinel value in the sorted buckets

If the edges finish before we complete the last scanline, we will
attempt to skip over the remaining lines using min_height of the
sentinel edge (MAX_INT). This causes us to read beyond the end of the
array of insertion buckets, unless we place a sentinel value in there to
break the loop.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

1 files changed, 2 insertions, 1 deletions

diff --git a/src/cairo-mono-scan-converter.c b/src/cairo-mono-scan-converter.c
index 2d2eaac8e..a617f484d 100644
--- a/src/cairo-mono-scan-converter.c
+++ b/src/cairo-mono-scan-converter.c
@@ -119,7 +119,7 @@ floored_muldivrem(int x, int a, int b)
 static cairo_status_t
 polygon_init (struct polygon *polygon, int ymin, int ymax)
 {
-    unsigned h = ymax - ymin;
+    unsigned h = ymax - ymin + 1;
 
     polygon->y_buckets = polygon->y_buckets_embedded;
     if (h > ARRAY_LENGTH (polygon->y_buckets_embedded)) {
@@ -128,6 +128,7 @@ polygon_init (struct polygon *polygon, int ymin, int ymax)
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
     memset (polygon->y_buckets, 0, h * sizeof (struct edge *));
+    polygon->y_buckets[h-1] = (void *)-1;
 
     polygon->ymin = ymin;
     polygon->ymax = ymax;