Comment 21 for bug 918791

"if x or y < 0, set them to 0 (and decrement with/height accordingly)"

If it is possible in this context to have negative x or y, it is also possible to have them larger than width and heigth by absolute value, so that when decrementing width/height accordingly, width/height becomes negative too.

There's more: this function does not check for w/h being positive too, just like it doesn't for x/y. And again, if it is possible to have x<0 or y<0 there, it might be just as well possible to have w<0 or h<0 here.

And with w<0 or h<0, we'll most likely crash too.

So indeed, some (upstream) verification is needed here -- where these negative values are coming from, whenever it is EVER okay to have them, what to do with these, and where to check (I guess the check should be done somewhere in the upper layer).

Thanks,

/mjt