From 0d1935e3d8b03ccfa73f5c739d40acb2acfef0f1 Mon Sep 17 00:00:00 2001
From: dan <dan>
Date: Mon, 17 Jan 2000 04:30:52 +0000
Subject: [PATCH] Fixed a crashing bug in the multi vertical gradient code.

---
 wrlib/gradient.c | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/wrlib/gradient.c b/wrlib/gradient.c
index 2997e584..7ca89eaa 100644
--- a/wrlib/gradient.c
+++ b/wrlib/gradient.c
@@ -398,22 +398,25 @@ renderMVGradient(unsigned width, unsigned height, RColor **colors, int count)
     gg = g>>16;
     bb = b>>16;
 
-    tmp = ptr;    
-    for (x=0; x<width/4; x++) {
-	*ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
-	*ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
-	*ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
-	*ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
-    }
-    switch (width%4) {
-     case 3: *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
-     case 2: *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
-     case 1: *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
-    }
-    
-    for (j=k+1; j<width; j++) {
-	memcpy(ptr, tmp, width*3);
-	ptr += width*3;
+    if (k<height) {
+        tmp = ptr;
+        for (x=0; x<width/4; x++) {
+            *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
+            *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
+            *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
+            *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
+        }
+        switch (width%4) {
+        case 3: *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
+        case 2: *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
+        case 1: *ptr++ = rr; *ptr++ = gg; *ptr++ = bb;
+        default: break;
+        }
+
+        for (j=k+1; j<height; j++) {
+            memcpy(ptr, tmp, width*3);
+            ptr += width*3;
+        }
     }
     
     return image;