To avoid any possibility of uninitialized memory.
The exceptions are:
- where the allocation is immediately overwritten by a memcpy or struct copy.
- arrays of structs to avoid any performance impact (except when the
array is returned by the public API).
Not all platforms handle a zero sized allocation in calloc the
same. This macro ensures that _cairo_calloc(0) always returns NULL
similar to _cairo_malloc(0).
GCC 14 introduces a new -Walloc-size included in -Wextra which gives:
```
src/cairo-ps-surface.c:3524:18: warning: allocation of insufficient size ‘1’ for type ‘cairo_ps_form_t’ {aka ‘struct _cairo_ps_form’} with size ‘88’ [-Walloc-size]
```
The calloc prototype is:
```
void *calloc(size_t nmemb, size_t size);
```
So, just swap the number of members and size arguments to match the prototype, as
we're initialising 1 struct of size `sizeof(cairo_ps_form_t)`. GCC then sees we're not
doing anything wrong.
Signed-off-by: Sam James <sam@gentoo.org>
This implements Type 3 color fonts for PDF for any font with a
CAIRO_SCALED_GLYPH_INFO_RECORDING_SURFACE. This includes user-fonts,
SVG fonts, and COLR fonts.
Glyphs with foreground colors are not yet implemented as Type 3 glyphs
and will be rendered as images by cairo-surface.
The problem is _cairo_recording_surface_replay_and_create_regions()
stores the cairo_recording_region_type_t in the same structure as the
recording commands. This does not work well when the recording surface
is used as source by multiple surfaces
Fix this by moving the cairo_recording_region_type_t into a separate
struct cairo_recording_regions_array_t. This struct is stored in a
list that allows multiple create regions results to be store in the
surface.
The new function _cairo_recording_surface_region_array_attach() is
used to create a new cairo_recording_regions_array_t, attach it to the
recording surface and return a unique region id.
The _cairo_recording_surface_replay_and_create_regions() and
_cairo_recording_surface_replay_region() functions use this region id
to identify the cairo_recording_regions_array_t.
To handle nested recording surfaces, when replaying a recording, the
region id is passed to the target as an extra parameter in the surface
pattern. The wrapper surface makes a temporary copy of the pattern to
ensure the snapshot pattern in the recording surface is not modified.
cairo_recording_regions_array_t has a reference count so the target
can hold on to the cairo_recording_regions_array_t after the paginated
surface has called _cairo_recording_surface_region_array_remove().
According to valgrind, there is a use-after-free here. The function
_cairo_ps_surface_emit_surface() temporarily replaces some member of a
struct and then later re-sets it. However, there is an early return
possible that would skip that part of the code.
This commit moves the re-set up so that no freed pointers are left
behind. This seems to fix the crash.
Signed-off-by: Uli Schlachter <psychon@znc.in>
When taking the CAIRO_PS_COMPRESS_DEFLATE branch of the switch
statement in _cairo_ps_surface_emit_base85_string, memory is freed
a second time when closing the deflate_stream fails after performing a
write.
The status is now simply returned instead of attempting to free it
again.
Found via `codespell -i 3 -w -I ../cairo-word-whitelist.txt -L tim,ned,uint`
Follow up of 12cb59be7d
Reviewed-by: Bryce Harrington <bryce@bryceharrington.org>
Run the command below suggested by geirha in ##sed@irc.freenode.net.
git grep -l 'http://.*cairographics.org' | xargs sed -i 's|http\(://\([[:alnum:].-]*\.\)\{0,1\}cairographics\.org\)|https\1|g'
Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
_cairo_malloc(0) always returns NULL, but has not been used
consistently. This patch replaces many calls to malloc() with
_cairo_malloc().
Fixes: fdo# 101547
CVE: CVE-2017-9814 Heap buffer overflow at cairo-truetype-subset.c:1299
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
When image data is emitted as strings (required when an image is used
in a PaintProc), the base85 encoded data was emitted inside PS strings
(...) and the image filters included an ASCI85Decode filter.
This has been changed to emit the strings as ASCII85 strings <~...~>
and remove the ASCII85Decode filter since the base85 is decoded when
the string is parsed.
Also factor out the string data source procedure into the prolog.
Previously it was assumed the mime image size is the same as the cairo
image surface size. When using the 1 bpp formats (CCITT, JBIG2),
creating a cairo image of the same size will have very large memory
requirements and in some case may exceed the pixman image size
limits. In these cases it is useful to allow the mime image to have a
different resolution to the cairo image and in the PDF/PS output scale
the mime image to be the same physical size as the cairo image.
In PDF, this is easy as all PDF images are scaled to 1x1 unit and the
CTM is used to scale the image to the required size. The PS surface
has been changed to also scale images to 1x1 and use the CTM to get
the required size.
This completes the full set of PDF/PS image filters allowing image
data to be passed though without decompressing then recompresssing in
a less efficient format.
The difficulty with CCITT_FAX is it needs some decoding parameters
that are not stored inside the image data. This is achieved by using
an additional mime type CCITT_FAX_PARAMS that contains the params in
key=value format.
If the image operator does not read all the ASCII85 data, the PS
interpreter will try to execute the next byte of unread data.
Define our own image operator that calls flushfile (reads until end of
file) on the filter after drawing the image.
https://bugs.freedesktop.org/show_bug.cgi?id=84811
