To avoid any possibility of uninitialized memory.
The exceptions are:
- where the allocation is immediately overwritten by a memcpy or struct copy.
- arrays of structs to avoid any performance impact (except when the
array is returned by the public API).
On 64-bit windows, long is 32-bit. When compiling there are a large
number of warnings about mismatched sizes when casting long to/from a
pointer.
Use the (u)intptr_t type for any integer that will have a pointer stored
in it. Use a (u)intptr_t cast when integers are stored in pointers to
silence warnings.
Fixes#263
_cairo_malloc(0) always returns NULL, but has not been used
consistently. This patch replaces many calls to malloc() with
_cairo_malloc().
Fixes: fdo# 101547
CVE: CVE-2017-9814 Heap buffer overflow at cairo-truetype-subset.c:1299
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
Before the intersection code was not taking into account that both
quotients are required to be in the range (0,1) for the segments to
intersect or handling the case of negative numerators and denominators.
The fast path for transforming a path by a simple scale factor, forgot
to fix up the orientation of the box if that scale factor was negative.
Reported-by: Edward Zimmermann <Edward.Zimmermann@cib.de>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
_cairo_path_fixed_last_op() contains an assertion, which gcc doesn't
like to inline. Since it is a static function, which basically
accesses a value, gcc will inline it anyway when assertions are
disabled, so remove the "inline" hint to reduce gcc warning noise when
doing debug builds.
Fixes:
cairo-path-fixed.c: In function '_cairo_path_fixed_drop_line_to':
cairo-path-fixed.c:373:1: warning: inlining failed in call to
'_cairo_path_fixed_last_op.isra.5.part.6': call is unlikely and code
size would grow [-Winline]
cairo-path-fixed.c:400:1: warning: called from here [-Winline]
...
The plan was "path: Skip calls to zero-length memcpy". However, this skipped
calls if the buffer was still empty, which means that it skipped all calls.
Fixes: Half the test suite, lots of assertion failures
Signed-off-by: Uli Schlachter <psychon@znc.in>
We attempt to copy 0 points onto the array of path points for a
close-path. This is pointless and an unnecessary function call under
MSVC at least.
Based on a patch by Steve Snyder, incorporating Behdad's review
comments.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=37836
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Having spent the last dev cycle looking at how we could specialize the
compositors for various backends, we once again look for the
commonalities in order to reduce the duplication. In part this is
motivated by the idea that spans is a good interface for both the
existent GL backend and pixman, and so they deserve a dedicated
compositor. xcb/xlib target an identical rendering system and so they
should be using the same compositor, and it should be possible to run
that same compositor locally against pixman to generate reference tests.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
P.S. This brings massive upheaval (read breakage) I've tried delaying in
order to fix as many things as possible but now this one patch does far,
far, far too much. Apologies in advance for breaking your favourite
backend, but trust me in that the end result will be much better. :)
In step 1 of speeding up stroking, we introduce contours as a means for
tracking the connected edges around the stroke. By keeping track of
these chains, we can analyse the edges as we proceed and eliminate
redundant vertices speeding up rasterisation.
Coincidentally fixes line-width-tolerance (looks like a combination of
using spline tangent vectors and tolerance).
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Since we discard empty fill boxes whilst filling, we can also treat
horizontal/vertical lines as a filled box and so proceed with the
rectangular fast path in the presence of
cairo_rectangle (x, y, w, h)
with w == 0 || h == 0.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
__cairo_path_fixed_is_rectangle() is used by the PS and PDF backends
to check if a path is equivalent to a rectangle when stroking. This is
different from being a rectangle when filling, because of the implicit
close_path appended to every subpath when filling.
Fixes stroke-open-box.
See https://bugs.freedesktop.org/show_bug.cgi?id=34560
gcc complains that:
cairo-path-fixed.c:400: warning: inlining failed in call to
'_cairo_path_fixed_drop_line_to': call is unlikely and code size
would grow
Path are always interpreted in forward direction, so the ability of
interpreting in the opposite direction (which is very unlikely to be
useful at all) can be removed.
The additional time spent in the computation of tight extents for the
curve_to operation doesn't seem to be significant, but it makes the
extents computations faster and the approximations more accurate.
current_point and last_move_to were previously left in their old
position (which could lead to incorrect flag computation if other
operations were added to the path) and flags were not updated.
Only fill_maybe_region can change its value because the transformation
preserves vertical and horizontal lines, but can move the points and
make them integer if they were not or non-integer if they were.
Recomputing it is just as easy as checking if all the points are
integer and the path is fill_is_rectilinear.
Only fill_maybe_region can change its value because the transformation
preserves vertical and horizontal lines, but can move the points and
make them integer if they were not or non-integer if they were.
Recomputing it is just as easy as checking if all the points are
integer and the path is fill_is_rectilinear.
Instead of explicitly calling _cairo_fixed_move_to, setting the
needs_move_to flags is sufficient because the current_point is already
updeted correctly.
Clean up the code and make sure that _cairo_path_fixed_translate is
used whenever the _cairo_fixed_to_double rounding would result in the
matrix being approximated with a translation.
Now move_to's are actually added to the path when followed by a
drawing operation (line_to, curve_to or close_path).
This is implemented by updating the current_point and setting the
needs_move_to when a move_to operation is requested.
Whenever a drawing operation is requested and the needs_move_to flag
is set, a move_to is added before the drawing operation.
When a degenerate line_to is followed by a curve_to operation, the
line_to can be safely dropped, just like for degenerate line_to
followed by line_to.
The low-level line_to optimizations can be implemented in a more
abstract way using _cairo_path_fixed_penultimate_point and
_cairo_path_fixed_drop_line_to.
Instead of explicitly computing the flag in close_path, manually close
the path with a line_to, then drop the last operation if it is a
line_to (it might be another operation if the line_to was ignored
because it would have been degenerate).
Add a function to get the penultimate point and another one to drop
the last operation (assuming it is a line_to).
This allows some more abstraction in the line_to and close_path code.
Flags for the same path can be different depending on its "history"
(in particular if it was constructed and transformed they might be
different from what they would be if each point was transformed and
then the path constructed).
Make the hash independent of buf bucketing, extents and flags.
This makes the hash depend only on the actual content of the path, not
on how it is stored or on any computed property.
Remove _cairo_path_fixed_is_equal and use _cairo_path_fixed_equal
instead.
The latter function can recognize that two paths are equal even if the
drawing commands have been partitioned in a different way in the buf
list.
Instead of simply doubling the buffer size every time we overflow a point
or an op, enlarge the buffer to fit twice the number of used points and
ops. We expect paths to be fairly consistent in the mix of operations,
and this allows the buffer size to tune itself to actual usage and reduce
wastage.
