fdo-mirrors/cairo
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/cairo/cairo.git synced 2025-12-26 14:40:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Avoid a use-after-free

Browse source 
asan was complaining that the limits struct goes out
of scope before it is used via the pointer in the polygon struct,
and it is right:

==386746==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffd3ccebdfc at pc 0x7f783d5eaaee bp 0x7ffd3cceba80 sp 0x7ffd3cceba70
READ of size 4 at 0x7ffd3ccebdfc thread T0
    #0 0x7f783d5eaaed in _add_clipped_edge ../src/cairo-polygon.c:351
    #1 0x7f783d5ebba3 in _cairo_polygon_add_edge ../src/cairo-polygon.c:520
    #2 0x7f783d5ebc82 in _cairo_polygon_add_external_edge ../src/cairo-polygon.c:530
    #3 0x7f783d582149 in _cairo_filler_line_to ../src/cairo-path-fill.c:63
    #4 0x7f783d588d9c in _cairo_path_fixed_interpret ../src/cairo-path-fixed.c:831
    #5 0x7f783d582a44 in _cairo_path_fixed_fill_to_polygon ../src/cairo-path-fill.c:147
    #6 0x7f783d6204fe in _cairo_spans_compositor_fill ../src/cairo-spans-compositor.c:1151
    #7 0x7f783d5126de in _cairo_compositor_fill ../src/cairo-compositor.c:203
    #8 0x7f783d5571f9 in _cairo_image_surface_fill ../src/cairo-image-surface.c:1003
    #9 0x7f783d647f2f in _cairo_surface_fill ../src/cairo-surface.c:2424
    #10 0x7f783d52ebea in _cairo_gstate_fill ../src/cairo-gstate.c:1312
    #11 0x7f783d51cca4 in _cairo_default_context_fill ../src/cairo-default-context.c:1057
    #12 0x7f783d6812d6 in cairo_fill ../src/cairo.c:2421
This commit is contained in:
Matthias Clasen 2021-01-22 13:28:44 -05:00
parent 36f5dee473
commit b345be5afe
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/cairo-spans-compositor.c
View file

@ -1128,6 +1128,7 @@ _cairo_spans_compositor_fill (const cairo_compositor_t *_compositor,
}
if (status == CAIRO_INT_STATUS_UNSUPPORTED) {
cairo_polygon_t polygon;
cairo_box_t limits;
TRACE((stderr, "%s - polygon\n", __FUNCTION__));
@ -1138,7 +1139,6 @@ _cairo_spans_compositor_fill (const cairo_compositor_t *_compositor,
if (extents->clip->num_boxes == 1) {
_cairo_polygon_init (&polygon, extents->clip->boxes, 1);
} else {
cairo_box_t limits;
_cairo_box_from_rectangle (&limits, &extents->unbounded);
_cairo_polygon_init (&polygon, &limits, 1);
}