Re: [AD] bugfix in floodfill()

[Eric Botcazou <ebotcazou@xxxxxxxxxx>]

> the following program exploits a bug in floodfill.

Is it remotely exploitable? ;-)

> The problem is a limit of 32767 elements in a linked list, but with this
> evil example the linked list needs a number of elements proportional to the 
> number of pixels on screen.

The mere use of short ints in the structure is evil, but I'm not sure that I 
want to double the memory footprint so let's go for the status quo.

> Patch attached.

@@ -28,7 +28,7 @@
    short flags;                  /* status of the segment */
    short lpos, rpos;             /* left and right ends of segment */
    short y;                      /* y coordinate of the segment */
-   short next;                   /* linked list if several per line */
+   int next;                     /* linked list if several per line */
 } FLOODED_LINE;

Do you think it could be worth while to switch to 'unsigned int'? And you 
could put an ASSERT at the critical point.

-- 
Eric Botcazou