Bug fix: line rasterizer may overflow the image buffer

Author: 38

src/drawing/backend_impl/canvas.rs

@@ -112,7 +112,8 @@ impl DrawingBackend for CanvasBackend {
             return Ok(());
         }
 
-        self.context.set_stroke_style(&make_canvas_color(style.as_color()));
+        self.context
+            .set_stroke_style(&make_canvas_color(style.as_color()));
         self.context.set_line_width(style.stroke_width() as f64);
         self.context.begin_path();
         self.context.move_to(f64::from(from.0), f64::from(from.1));

src/drawing/rasterizer/line.rs

@@ -75,6 +75,12 @@ pub fn draw_line<DB: DrawingBackend, S: BackendStyle>(
         (from, to)
     };
 
+    let mut size_limit = back.get_size();
+
+    if steep {
+        size_limit = (size_limit.1, size_limit.0);
+    }
+
     let grad = f64::from(to.1 - from.1) / f64::from(to.0 - from.0);
 
     let mut put_pixel = |(x, y): BackendCoord, b: f64| {
@@ -87,12 +93,24 @@ pub fn draw_line<DB: DrawingBackend, S: BackendStyle>(
 
     let mut y = f64::from(from.1);
 
-    for x in from.0..=to.0 {
+    let y_step_limit = (f64::from(to.1.min(size_limit.1 as i32 - 1) - from.1) / grad).ceil() as i32;
+
+    for x in from.0..=to.0.min(size_limit.0 as i32 - 2).min(from.0 + y_step_limit) {
         check_result!(put_pixel((x, y as i32), 1.0 + y.floor() - y));
         check_result!(put_pixel((x, y as i32 + 1), y - y.floor()));
 
         y += grad;
     }
 
+    if to.0 >= (size_limit.0 as i32) - 1 && y < f64::from(to.1) {
+        let x = size_limit.0 as i32 - 1;
+        if 1.0 + y.floor() - y > 1e-5 {
+            check_result!(put_pixel((x, y as i32), 1.0 + y.floor() - y));
+        }
+        if y - y.floor() > 1e-5 && y + 1.0 < f64::from(to.1) {
+            check_result!(put_pixel((x, y as i32 + 1), y - y.floor()));
+        }
+    }
+
     Ok(())
 }

src/drawing/rasterizer/path.rs

@@ -40,7 +40,7 @@ fn compute_polygon_vertex(triple: &[BackendCoord; 3], d: f64) -> BackendCoord {
     let b1 = -b_t.1;
     let c1 = b_p.1 - a_p.1;
 
-    // This is the coner case that 
+    // This is the coner case that
     if (a0 * b1 - a1 * b0).abs() < 1e-10 {
         return (a_p.0 as i32, a_p.1 as i32);
     }