fdo-mirrors/cairo
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/cairo/cairo.git synced 2025-12-20 07:00:08 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

ps: Fix crash in self-copy-overlap

Browse source 
According to valgrind, there is a use-after-free here. The function
_cairo_ps_surface_emit_surface() temporarily replaces some member of a
struct and then later re-sets it. However, there is an early return
possible that would skip that part of the code.

This commit moves the re-set up so that no freed pointers are left
behind. This seems to fix the crash.

Signed-off-by: Uli Schlachter <psychon@znc.in>
This commit is contained in:
Uli Schlachter 2021-08-15 18:26:53 +02:00
parent c1aaaff880
commit a2d05a0c34
3 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.gitlab-ci/ignore-ps2-argb32.txt
View file

@ -161,6 +161,7 @@ rounded-rectangle-fill
rounded-rectangle-stroke rounded-rectangle-stroke
scale-offset-image scale-offset-image
scale-offset-similar scale-offset-similar
self-copy-overlap
stroke-ctm-caps stroke-ctm-caps
stroke-clipped stroke-clipped
stroke-image stroke-image

1
.gitlab-ci/ignore-ps3-argb32.txt
View file

@ -172,6 +172,7 @@ rounded-rectangle-fill
rounded-rectangle-stroke rounded-rectangle-stroke
scale-offset-image scale-offset-image
scale-offset-similar scale-offset-similar
self-copy-overlap
stroke-ctm-caps stroke-ctm-caps
stroke-clipped stroke-clipped
stroke-image stroke-image

2
src/cairo-ps-surface.c
View file

@ -3713,11 +3713,11 @@ _cairo_ps_surface_emit_surface (cairo_ps_surface_t *surface,
status = _cairo_memory_stream_destroy (surface->stream, &data, &length); status = _cairo_memory_stream_destroy (surface->stream, &data, &length);
free (data); free (data);
surface->stream = old_stream;
if (unlikely (status)) if (unlikely (status))
return status; return status;
params->approx_size = length; params->approx_size = length;
surface->stream = old_stream;
_cairo_pdf_operators_set_stream (&surface->pdf_operators, _cairo_pdf_operators_set_stream (&surface->pdf_operators,
surface->stream); surface->stream);
} }