Created attachment 402099 Possible patch
Looks like the problem occurs because the size passed in fbCompose() to the mmx function are negative (either h_this or w_this is < 0).
The mmx equivalent in fbmmx.c seem to expect a CARD16 for width / height so that might explain the problem.
This patch seems to address the issue at least in my reproducer, but I am not sure of its possible side effects.
Created attachment 402099
Possible patch
Looks like the problem occurs because the size passed in fbCompose() to the mmx function are negative (either h_this or w_this is < 0).
The mmx equivalent in fbmmx.c seem to expect a CARD16 for width / height so that might explain the problem.
This patch seems to address the issue at least in my reproducer, but I am not sure of its possible side effects.