From f77f6f3322dcdfc129fb1aec26ae10b91912e983 Mon Sep 17 00:00:00 2001
From: Benjamin Otte <otte@redhat.com>
Date: Sun, 16 Sep 2012 18:44:59 +0200
Subject: [PATCH] cssvalue: Fix out-of-bounds in array transition code

---
 gtk/gtkcssarrayvalue.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gtk/gtkcssarrayvalue.c b/gtk/gtkcssarrayvalue.c
index de69c42900..dadedba90d 100644
--- a/gtk/gtkcssarrayvalue.c
+++ b/gtk/gtkcssarrayvalue.c
@@ -126,8 +126,8 @@ gtk_css_value_array_transition_repeat (GtkCssValue *start,
 
   for (i = 0; i < n; i++)
     {
-      transitions[i] = _gtk_css_value_transition (start->values[i],
-                                                  end->values[i],
+      transitions[i] = _gtk_css_value_transition (start->values[i % start->n_values],
+                                                  end->values[i % end->n_values],
                                                   property_id,
                                                   progress);
       if (transitions[i] == NULL)