Skip to content

Commit 528f02f

Browse files
committed
Address PR feedback: handle negative width/height in bounds check
1 parent 05d1d10 commit 528f02f

File tree

2 files changed

+25
-3
lines changed

2 files changed

+25
-3
lines changed

src/System.Drawing.Common/src/System/Drawing/Graphics.cs

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1226,10 +1226,29 @@ public void FillRectangle(Brush brush, float x, float y, float width, float heig
12261226
// on a 24bppRgb bitmap, causing an AccessViolationException (or ExecutionEngineException in .NET 9+).
12271227
// We validate the parameters here to prevent the crash.
12281228
if (SmoothingMode == Drawing2D.SmoothingMode.AntiAlias &&
1229-
_backingImage is { PixelFormat: PixelFormat.Format24bppRgb } &&
1230-
(x < 0 || y < 0 || x + width > _backingImage.Width || y + height > _backingImage.Height))
1229+
_backingImage is { PixelFormat: PixelFormat.Format24bppRgb })
12311230
{
1232-
throw new ArgumentException(SR.ArgumentException_GdiPlus_AntiAlias24bppRgbBounds);
1231+
float left = x;
1232+
float right = x + width;
1233+
float top = y;
1234+
float bottom = y + height;
1235+
1236+
if (width < 0)
1237+
{
1238+
left = right;
1239+
right = x;
1240+
}
1241+
1242+
if (height < 0)
1243+
{
1244+
top = bottom;
1245+
bottom = y;
1246+
}
1247+
1248+
if (left < 0 || top < 0 || right > _backingImage.Width || bottom > _backingImage.Height)
1249+
{
1250+
throw new ArgumentException(SR.ArgumentException_GdiPlus_AntiAlias24bppRgbBounds);
1251+
}
12331252
}
12341253

12351254
CheckErrorStatus(PInvokeGdiPlus.GdipFillRectangle(

src/System.Drawing.Common/tests/System/Drawing/GraphicsTests.cs

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3009,6 +3009,8 @@ public void Graphics_FillRoundedRectangle_Float()
30093009
[InlineData(10, -10, 100, 100)] // Out of bounds (top)
30103010
[InlineData(200, 10, 100, 100)] // Out of bounds (right)
30113011
[InlineData(10, 200, 100, 100)] // Out of bounds (bottom)
3012+
[InlineData(10, 10, -100, 100)] // Out of bounds (negative width extending left)
3013+
[InlineData(10, 10, 100, -100)] // Out of bounds (negative height extending top)
30123014
public void FillRectangle_AntiAlias_24bppRgb_OutOfBounds_ThrowsArgumentException(float x, float y, float width, float height)
30133015
{
30143016
using Bitmap bmp = new(256, 256, PixelFormat.Format24bppRgb);
@@ -3025,6 +3027,7 @@ public void FillRectangle_AntiAlias_24bppRgb_OutOfBounds_ThrowsArgumentException
30253027
[Theory]
30263028
[InlineData(0, 0, 100, 100)] // Within bounds
30273029
[InlineData(156, 156, 100, 100)] // Exactly on bounds (256 - 100 = 156)
3030+
[InlineData(100, 100, -50, -50)] // Within bounds (negative width/height)
30283031
public void FillRectangle_AntiAlias_24bppRgb_WithinBounds_Success(float x, float y, float width, float height)
30293032
{
30303033
using Bitmap bmp = new(256, 256, PixelFormat.Format24bppRgb);

0 commit comments

Comments
 (0)