From 58b5aa2706ec95403b9fb6f364acd95c78ba6236 Mon Sep 17 00:00:00 2001
From: Heiko Lewin <heiko.lewin@worldiety.de>
Date: Mon, 4 Jan 2021 16:16:15 +0100
Subject: [PATCH] Added checks for failed strdups in cairo-recording-surface.c

---
 src/cairo-recording-surface.c | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/src/cairo-recording-surface.c b/src/cairo-recording-surface.c
index 6ce158036..144fa9745 100644
--- a/src/cairo-recording-surface.c
+++ b/src/cairo-recording-surface.c
@@ -1125,9 +1125,18 @@ _cairo_recording_surface_tag (void			 *abstract_surface,
 
     command->begin = begin;
     command->tag_name = strdup (tag_name);
+    if (unlikely (command->tag_name == NULL)) {
+	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+	goto CLEANUP_COMMAND;
+    }
     if (begin) {
-	if (attributes)
+	if (attributes) {
 	    command->attributes = strdup (attributes);
+	    if (unlikely (command->attributes == NULL)) {
+		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+		goto CLEANUP_STRINGS;
+	    }
+	}
 
 	status = _cairo_pattern_init_snapshot (&command->source.base, source);
 	if (unlikely (status))
@@ -1144,9 +1153,9 @@ _cairo_recording_surface_tag (void			 *abstract_surface,
     status = _cairo_recording_surface_commit (surface, &command->header);
     if (unlikely (status)) {
 	if (begin)
-	    goto CLEANUP_STRINGS;
-	else
 	    goto CLEANUP_STYLE;
+	else
+	    goto CLEANUP_STRINGS;
     }
 
     _cairo_recording_surface_destroy_bbtree (surface);
@@ -1451,9 +1460,18 @@ _cairo_recording_surface_copy__tag (cairo_recording_surface_t *surface,
 
     command->begin = src->tag.begin;
     command->tag_name = strdup (src->tag.tag_name);
+    if (unlikely (command->tag_name == NULL)) {
+	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+	goto err_command;
+    }
     if (src->tag.begin) {
-	if (src->tag.attributes)
+	if (src->tag.attributes) {
 	    command->attributes = strdup (src->tag.attributes);
+	    if (unlikely (command->attributes == NULL)) {
+		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+		goto err_command;
+	    }
+	}
 
 	status = _cairo_pattern_init_copy (&command->source.base,
 					   &src->tag.source.base);
@@ -1472,9 +1490,9 @@ _cairo_recording_surface_copy__tag (cairo_recording_surface_t *surface,
     status = _cairo_recording_surface_commit (surface, &command->header);
     if (unlikely (status)) {
 	if (src->tag.begin)
-	    goto err_command;
-	else
 	    goto err_style;
+	else
+	    goto err_command;
     }
 
     return CAIRO_STATUS_SUCCESS;