From 13e7260a237333687a25a1bff105c7c41c103379 Mon Sep 17 00:00:00 2001
From: Harshula Jayasuriya <harshula@hj.id.au>
Date: Sun, 20 Dec 2015 13:26:27 +0100
Subject: [PATCH] Close #2964: Fix Segmentation fault in rtengine::processImage
 due to crop

When a pp3 contains negative values for X & Y in the Crop section these get
parsed into array indexing code without being checked and set to 0. This results
in a segmentation fault because the code tries to index the '-1' element of the
array.
---
 rtengine/simpleprocess.cc | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/rtengine/simpleprocess.cc b/rtengine/simpleprocess.cc
index 665a3a236..da44b25e3 100644
--- a/rtengine/simpleprocess.cc
+++ b/rtengine/simpleprocess.cc
@@ -77,6 +77,14 @@ IImage16* processImage (ProcessingJob* pjob, int& errorCode, ProgressListener* p
         params.crop.w = fw;
         params.crop.h = fh;
     } else {
+        if (params.crop.x < 0) {
+            params.crop.x = 0;
+        }
+
+        if (params.crop.y < 0) {
+            params.crop.y = 0;
+        }
+
         if ((params.crop.x + params.crop.w) > fw) {
             // crop overflow in the width dimension ; we trim it
             params.crop.w = fw - params.crop.x;