When `_cairo_svg_surface_create_for_document()` failed, it will free the
`document` by `_cairo_svg_document_destroy()`. But after `_cairo_svg_surface_create_for_document` return a error status, the `document` is still used and destoryed by `_cairo_svg_document_destroy()`.
We remove the redundant `_cairo_svg_document_destroy()` in `_cairo_svg_surface_create_for_stream_internal` to avoid this bug.
This fixes#561.
Signed-off-by: Feysh INC <opensource@feysh.com>
When `font_face` is freed by `cairo_font_face_destroy()` at line 1,150,
the following call `_cairo_font_face_set_error (font_face, status)`
causes a use after free.
We moved up the `_cairo_font_face_set_error (font_face, status)` before
`cairo_font_face_destroy()` to avoid the use after free.
Signed-off-by: Feysh INC <opensource@feysh.com>
When `_mono_scan_converter_init` failed,
`self->converter->polygon` will be freed by `polygon_fini()`. However,
the `bail` branch still called `polygon_fini()` to free
`self->converter->polygon`.
We remvoe the redundant `polygon_fini()` in `_mono_scan_converter_init`
to avoid the double free.
This fixes#557.
Signed-off-by: Feysh INC <opensource@feysh.com>
When taking the CAIRO_PS_COMPRESS_DEFLATE branch of the switch
statement in _cairo_ps_surface_emit_base85_string, memory is freed
a second time when closing the deflate_stream fails after performing a
write.
The status is now simply returned instead of attempting to free it
again.
There may be different versions of fonts with the same name. As an
additional check, compare the 'head' table wich contains the checksum
for the font.
Also, load the DWrite tables directly to avoid the memcpy in
load_truetype_table.
If the default font is not found, return CAIRO_INT_STATUS_UNSUPPORTED
to cause _cairo_toy_font_face_create_impl_face to create the Twin user
font fallback.
In !309 Taylor R Campbell found a number of instances of ctype
incorrectly passed a signed char. In many cases, where only ASCII
characters are used, the code should have been using the cairo version
of the ctype function to avoid locale issues.
Before this commit, calling cairo_device_finish() on a cairo-script
context did not actually do anything in the backend. Thus, it was
possible to continue emitting output on the script context even after it
was finished, which means that API user had no way of preventing
use-after-free bugs in their write callback. Bug 277 triggers this via
detaching a snapshot, but I guess one could also simply continue drawing
to a script surface.
This commit implements the finish function by closing the underlying
stream.
However, that was not enough to fix things. This commit also turns
writing into a stream into a no-op after the stream was closed.
I checked that the new test case actually fails before this commit and
is indeed fixed by it.
Fixes: https://gitlab.freedesktop.org/cairo/cairo/-/issues/277
Signed-off-by: Uli Schlachter <psychon@znc.in>
