From cbaca916dbdeef02fc905f05d999a9f8e53a8b46 Mon Sep 17 00:00:00 2001 From: "longsonr@gmail.com" Date: Wed, 28 Mar 2007 01:54:39 -0700 Subject: [PATCH] Bug 374882. r+sr=tor --- content/svg/content/src/nsSVGFilters.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/content/svg/content/src/nsSVGFilters.cpp b/content/svg/content/src/nsSVGFilters.cpp index 17cfd23c31f..e1a09c4674b 100644 --- a/content/svg/content/src/nsSVGFilters.cpp +++ b/content/svg/content/src/nsSVGFilters.cpp @@ -2559,6 +2559,9 @@ nsSVGFEOffsetElement::Filter(nsSVGFilterInstance *instance) val.Init(nsSVGUtils::Y, 0xff, fltY, nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER); offsetY = (PRInt32) instance->GetPrimitiveLength(&val); + if (abs(offsetX) >= rect.width || abs(offsetY) >= rect.height) + return NS_OK; + PRInt32 stride = fr.GetDataStride(); PRInt32 targetColumn = rect.x + offsetX; for (PRInt32 y = rect.y; y < rect.YMost(); y++) {