From 21389fbd8960c6ec08d0ff17473ace0f3633e3d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pablo=20Mart=C3=ADnez?=
 <58857054+elpekenin@users.noreply.github.com>
Date: Sun, 8 Oct 2023 01:29:27 +0200
Subject: [PATCH] [Bugfix] `qp_ellipse` overflow (#19005)

---
 quantum/painter/qp_draw_ellipse.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/quantum/painter/qp_draw_ellipse.c b/quantum/painter/qp_draw_ellipse.c
index e912a3e91f..9e77bca8b0 100644
--- a/quantum/painter/qp_draw_ellipse.c
+++ b/quantum/painter/qp_draw_ellipse.c
@@ -67,10 +67,10 @@ bool qp_ellipse(painter_device_t device, uint16_t x, uint16_t y, uint16_t sizex,
         return false;
     }
 
-    int16_t aa = ((int16_t)sizex) * ((int16_t)sizex);
-    int16_t bb = ((int16_t)sizey) * ((int16_t)sizey);
-    int16_t fa = 4 * ((int16_t)aa);
-    int16_t fb = 4 * ((int16_t)bb);
+    int32_t aa = ((int32_t)sizex) * ((int32_t)sizex);
+    int32_t bb = ((int32_t)sizey) * ((int32_t)sizey);
+    int32_t fa = 4 * aa;
+    int32_t fb = 4 * bb;
 
     int16_t dx = 0;
     int16_t dy = ((int16_t)sizey);
@@ -83,7 +83,7 @@ bool qp_ellipse(painter_device_t device, uint16_t x, uint16_t y, uint16_t sizex,
     }
 
     bool ret = true;
-    for (int16_t delta = (2 * bb) + (aa * (1 - (2 * sizey))); bb * dx <= aa * dy; dx++) {
+    for (int32_t delta = (2 * bb) + (aa * (1 - (2 * sizey))); bb * dx <= aa * dy; dx++) {
         if (!qp_ellipse_helper_impl(device, x, y, dx, dy, filled)) {
             ret = false;
             break;
@@ -98,7 +98,7 @@ bool qp_ellipse(painter_device_t device, uint16_t x, uint16_t y, uint16_t sizex,
     dx = sizex;
     dy = 0;
 
-    for (int16_t delta = (2 * aa) + (bb * (1 - (2 * sizex))); aa * dy <= bb * dx; dy++) {
+    for (int32_t delta = (2 * aa) + (bb * (1 - (2 * sizex))); aa * dy <= bb * dx; dy++) {
         if (!qp_ellipse_helper_impl(device, x, y, dx, dy, filled)) {
             ret = false;
             break;