We can't just move around the contents of the
passed-in string, we need to make a copy. This
was showing up as memory corruption in pango.
See https://gitlab.gnome.org/GNOME/pango/issues/346
_cairo_malloc(0) always returns NULL, but has not been used
consistently. This patch replaces many calls to malloc() with
_cairo_malloc().
Fixes: fdo# 101547
CVE: CVE-2017-9814 Heap buffer overflow at cairo-truetype-subset.c:1299
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
When a color glyph is completely clipped away, we
get the non-zero status 'nothing to do'. In that case,
we must not exit early, since there might still be work
to do for the other color glyphs.
This bug was showing up as color glyphs stopping to render
in GTK+ entries that are scrolled to the right, and also
as color glyphs not rendering inside the selection sometimes.
See https://bugzilla.gnome.org/show_bug.cgi?id=790255 and
https://bugzilla.gnome.org/show_bug.cgi?id=788071.
- Restructure the emit_surface code so that mime types are checked first.
- Add a test parameter to emit_surface to test if the surface will be emitted
as an image or recording instead checking the surface type as the attached
mime may override this.
- Mark surface as not clear when mime is attached to avoid optimizing away
"clear" surfaces that have mime attached.
- Include entire surface in analysis if mime attached (also fixes bug with
calculating the extents CONTENT_COLOR surfaces)
PDF XObjects need to specify the bounding box. Emit unbounded surfaces
when finishing as at this point the extents of all uses of the
unbounded surface are known.
This completes the full set of PDF/PS image filters allowing image
data to be passed though without decompressing then recompresssing in
a less efficient format.
The difficulty with CCITT_FAX is it needs some decoding parameters
that are not stored inside the image data. This is achieved by using
an additional mime type CCITT_FAX_PARAMS that contains the params in
key=value format.
In cairo, most operators are composited this way:
((src IN mask) OP dst) LERP_clip dst
but SOURCE and CLEAR operators are composited this way:
(src OP dst) LERP_(clip IN mask) dst
(why is this not specified anywhere in the docs or source tree?)
With color glyphs, we were not special-casing SOURCE and CLEAR.
We do now.
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=102661
Do away with the separate check for color glyphs - we can just
do the filtering, and if there are no color glyphs, it is a
no-op. As long as we only do this for fonts with color glyphs,
it should be fine.
Reduce repetition in composite_color_glyphs by breaking out
some helper functions.
Use paint instead of show_glyphs for color glyphs. To avoid
overhead, we only check for color glyphs if the font is known
to contain any. Paint clusters containing only color glyphs
and rewrite the inputs to remove the handled clusters and
glyphs.
In short, cairo_surface_create_similar inherits it, while
cairo_surface_create_similar_image doesn't. It wasn't obvious without
reading the code or explicitly checking the device scale of the new
surface.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=99094
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
"can be get" is incorrect grammar; "can be gotten" would be better, but
active voice is best.
Signed-off-by: Bryce Harrington <bryce@bryceharrington.org>
The cairo_tag_begin/cairo_tag_end API is for supporting hyperlinks and
creating tagged PDF files.
The source, ctm, and stroke style are passed to the backend to allow
these parameters to be used to specify hyperlink border attributes.
Explains how to use cairo_surface_set_mime_data so that the image always
gets used even if the MIME data cannot be.
Signed-off-by: jimmyfrasche <soapboxcicero@gmail.com>
This fixes this set of distcheck errors generating docs:
src/cairo-surface.c:1668: warning: Parameter described in source code
comment block but does not exist. FUNCTION:
cairo_surface_set_device_scale Parameter: sx.
src/cairo-surface.c:1668: warning: Parameter described in source code
comment block but does not exist. FUNCTION:
cairo_surface_set_device_scale Parameter: sy.
src/cairo-surface.c:1668: warning: Parameter description for
cairo_surface_set_device_scale::x_scale is missing in source code
comment block.
src/cairo-surface.c:1668: warning: Parameter description for
cairo_surface_set_device_scale::y_scale is missing in source code
comment block.
Signed-off-by: Bryce Harrington <b.harrington@samsung.com>
JBIG2 images may have shared global data that is stored in a separate
stream in PDF. The CAIRO_MIME_TYPE_JBIG2 mime type is for the JBIG2
data for each image. All images that use global data must also set
CAIRO_MIME_TYPE_JBIG2_GLOBAL_ID to a unique identifier. One of the
images must also set CAIRO_MIME_TYPE_JBIG2_GLOBAL to the global
data. The global data will be shared by all JBIG2 images with the same
CAIRO_MIME_TYPE_JBIG2_GLOBAL_ID.
We merge _cairo_surface_create_similar_scratch and
_cairo_surface_create_similar_solid into a single function named
_cairo_surface_create_scratch, to avoid confusion with
cairo_surface_create_similar which now will have a different
behaviour wrt the sizes and the device-scale.
_create_scratch assumes the width and height are in backend
coordinates, while create_similar does not.
We copy the _cairo_surface_create_similar_solid code into
cairo_surface_create_similar so that we can separate these later
as one wants to use backend sizes and one not.
If we do this in surface it will be applied twice then
we chain to a different surface, like e.g. a subsurface.
We also remove a hack in cairo-surface-wrapper where it compensated
for the device scale not being applied.
v2: Compute the backend CTM in ensure_scaled_font().
This fixes a crash in the api-special-cases with xlib-xcb when calling
cairo_clip_extents() on a context that refers to a finished surface.
The crash was a simple NULL pointer dereference, because the underlying xcb
surface that was used in xlib-xcb was gone and set to NULL already.
Signed-off-by: Uli Schlachter <psychon@znc.in>
Finished surfaces and surfaces with an error status must not be usable anymore,
so refuse to work on them.
This improves the result for api-special-cases.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=68014
Signed-off-by: Uli Schlachter <psychon@znc.in>
In a similar fashion to the previous commit, we also need to be wary of
users simply trying to read from a potentially freed user-data array.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
As we cleanup the user-data arrays, we call the user provided destroy
notifier callbacks. These callbacks are at liberty to write back into
the parent surface, and in particular try to write into the arrays that
we have just freed. This causes hard to control and fairly unpredictable
use-after-frees in the client, so lets just rule out the dangerous
behaviour.
References:https://bugzilla.mozilla.org/show_bug.cgi?id=722975
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
This problem was introduced in commit "xlib: Implement SHM fallbacks and fast
upload paths". Before, cairo_surface_mark_dirty() directly called
cairo_surface_mark_dirty_rectangle() with special "magical arguments" and thus
didn't need any checks on the surface status.
Fixes: api-special-cases
Signed-off-by: Uli Schlachter <psychon@znc.in>
In many places Cairo maps/unmaps surfaces to perform operations on the
raw image, but it doesn't care about the format being invalid. All of
these are appropriate users of _cairo_surface_map_to_image().
