From bd2b4ab43ee1a88ec9e4063a4f4598e12b2742e7 Mon Sep 17 00:00:00 2001 From: Adam Jackson Date: Fri, 31 Oct 2014 13:21:15 -0400 Subject: [PATCH] xcb: Don't crash when swapping a 0-sized glyph malloc(0) needn't return NULL, and on glibc, doesn't. Then we encounter a loop of the form do { ... } while (--c), which doesn't do quite what you were hoping for when c is initially 0. Since there's nothing to swap in this case, just bomb out. Signed-off-by: Adam Jackson --- src/cairo-xcb-surface-render.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/cairo-xcb-surface-render.c b/src/cairo-xcb-surface-render.c index b35bf4d04..044339bce 100644 --- a/src/cairo-xcb-surface-render.c +++ b/src/cairo-xcb-surface-render.c @@ -4470,6 +4470,9 @@ _cairo_xcb_surface_add_glyph (cairo_xcb_connection_t *connection, const uint8_t *d; uint8_t *new, *n; + if (c == 0) + break; + new = malloc (c); if (unlikely (new == NULL)) { status = _cairo_error (CAIRO_STATUS_NO_MEMORY); @@ -4498,6 +4501,9 @@ _cairo_xcb_surface_add_glyph (cairo_xcb_connection_t *connection, const uint32_t *d; uint32_t *new, *n; + if (c == 0) + break; + new = malloc (4 * c); if (unlikely (new == NULL)) { status = _cairo_error (CAIRO_STATUS_NO_MEMORY);