[lasem] svg_color_matrix: subregion may be greater than surface

[Emmanuel Pacaud <emmanuel src gnome org>]

commit a637cab8e393a05b6c2185221589a23b87f1df00
Author: Emmanuel Pacaud <emmanuel gnome org>
Date:   Sat Aug 1 23:34:59 2015 +0200

    svg_color_matrix: subregion may be greater than surface
    
    Don't try to access pixels outside of the surface.

 src/lsmsvgfiltersurface.c |   14 +++++++++++---
 1 files changed, 11 insertions(+), 3 deletions(-)
---
diff --git a/src/lsmsvgfiltersurface.c b/src/lsmsvgfiltersurface.c
index 4bda48d..42a53d5 100644
--- a/src/lsmsvgfiltersurface.c
+++ b/src/lsmsvgfiltersurface.c
@@ -473,7 +473,7 @@ lsm_svg_filter_surface_color_matrix (LsmSvgFilterSurface *input, LsmSvgFilterSur
        double cosval;
        double sinval;
        int ch;
-       gint x, y;
+       gint x, y, x1, x2, y1, y2;
        gint width, height;
        gint rowstride;
        gint sum;
@@ -493,6 +493,9 @@ lsm_svg_filter_surface_color_matrix (LsmSvgFilterSurface *input, LsmSvgFilterSur
            height != cairo_image_surface_get_height (output->surface))
                return;
 
+       if (height < 1 || width < 1)
+               return;
+
        memset (matrix, 0, sizeof (*matrix) * G_N_ELEMENTS (matrix));
 
        switch (type) {
@@ -553,8 +556,13 @@ lsm_svg_filter_surface_color_matrix (LsmSvgFilterSurface *input, LsmSvgFilterSur
        output_pixels = cairo_image_surface_get_data (output->surface);
        rowstride = cairo_image_surface_get_stride (input->surface);
 
-       for (y = input->subregion.y; y < input->subregion.y + input->subregion.height; y++)
-               for (x = input->subregion.x; x < input->subregion.x + input->subregion.width; x++) {
+       x1 = CLAMP (input->subregion.x, 0, width);
+       x2 = CLAMP (input->subregion.x + input->subregion.width, 0, width);
+       y1 = CLAMP (input->subregion.y, 0, height);
+       y2 = CLAMP (input->subregion.y + input->subregion.height, 0, height);
+
+       for (y = y1; y < y2; y++)
+               for (x = x1; x < x2; x++) {
                        int umch;
                        int alpha = in_pixels[4 * x + y * rowstride + channelmap[3]];
                        if (!alpha)