fdo-mirrors/cairo
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/cairo/cairo.git synced 2026-05-05 15:48:00 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix copying tags in a recording surface

Browse source 
The code was copying from the wrong member of an union. This caused a
huge num_dashes value to be read, which then caused a so large memory
allocation that malloc returned an error.

Fixes: https://gitlab.freedesktop.org/cairo/cairo/-/issues/448
Signed-off-by: Uli Schlachter <psychon@znc.in>
This commit is contained in:
Uli Schlachter 2020-12-26 16:17:58 +01:00
parent 979382dd30
commit a1dc600a07
3 changed files with 81 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/cairo-recording-surface.c
View file

@ -1456,17 +1456,17 @@ _cairo_recording_surface_copy__tag (cairo_recording_surface_t *surface,
command->attributes = strdup (src->tag.attributes);
status = _cairo_pattern_init_copy (&command->source.base,
&src->stroke.source.base);
&src->tag.source.base);
if (unlikely (status))
goto err_command;
status = _cairo_stroke_style_init_copy (&command->style,
&src->stroke.style);
&src->tag.style);
if (unlikely (status))
goto err_source;
command->ctm = src->stroke.ctm;
command->ctm_inverse = src->stroke.ctm_inverse;
command->ctm = src->tag.ctm;
command->ctm_inverse = src->tag.ctm_inverse;
}
status = _cairo_recording_surface_commit (surface, &command->header);

1
test/Makefile.sources
View file

@ -25,6 +25,7 @@ test_sources = \
big-trap.c \
bilevel-image.c \
bug-40410.c \
bug-448.c \
bug-51910.c \
bug-75705.c \
bug-84115.c \

76
test/bug-448.c Normal file
View file

@ -0,0 +1,76 @@
/*
* Copyright © 2020 Ben Pfaff & Uli Schlachter
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use, copy,
* modify, merge, publish, distribute, sublicense, and/or sell copies
* of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*
* Authors:
* Ben Pfaff <blp@cs.stanford.edu>
* Uli Schlachter <psychon@znc.in>
*/
#include "cairo-test.h"
static cairo_surface_t*
draw_recording ()
{
cairo_surface_t *recording;
cairo_rectangle_t extents;
cairo_t *cr;
extents.x = 0;
extents.y = 0;
extents.width = 10;
extents.height = 10;
recording = cairo_recording_surface_create (CAIRO_CONTENT_COLOR_ALPHA, &extents);
cr = cairo_create(recording);
cairo_tag_begin (cr, CAIRO_TAG_DEST, "name='dest'");
cairo_rectangle (cr, 3, 3, 4, 4);
cairo_stroke (cr);
cairo_tag_end (cr, CAIRO_TAG_DEST);
cairo_destroy(cr);
return recording;
}
static cairo_test_status_t
draw (cairo_t *cr, int width, int height)
{
cairo_surface_t *recording;
cairo_set_source_rgb (cr, 1, 1, 1);
cairo_paint (cr);
recording = draw_recording ();
cairo_set_source_surface (cr, recording, 0, 0);
cairo_paint (cr);
cairo_surface_destroy (recording);
return CAIRO_TEST_SUCCESS;
}
CAIRO_TEST (bug_448,
"Exercises a bug with the tag API",
"pdf", /* keywords */
NULL, /* requirements */
10, 10,
NULL, draw)