To avoid any possibility of uninitialized memory.
The exceptions are:
- where the allocation is immediately overwritten by a memcpy or struct copy.
- arrays of structs to avoid any performance impact (except when the
array is returned by the public API).
X11 use uint16_t for the width/height of things. Anything too large will
be truncated when sending the request to the X11 server. This commit
adds a size check to a function that did not check things and then later
caused a segmentation fault.
Not adding a test case because the test case from the below bug report
allocates 3,5 GiB of memory, which I find too much for a test.
Fixes: https://gitlab.freedesktop.org/cairo/cairo/-/issues/414
Signed-off-by: Uli Schlachter <psychon@znc.in>
_cairo_malloc(0) always returns NULL, but has not been used
consistently. This patch replaces many calls to malloc() with
_cairo_malloc().
Fixes: fdo# 101547
CVE: CVE-2017-9814 Heap buffer overflow at cairo-truetype-subset.c:1299
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
The code here wants to ignore errors for a specific request. To do so,
it sets a no-op error handler. However, it could happen that some
previous request caused an error and this error will also be ignored by
the no-op error handler.
To avoid this, call XSync() before setting the error handler. This makes
sure that all pending errors are handled.
Signed-off-by: Uli Schlachter <psychon@znc.in>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
If XShmGetImage() fails, the code tries to continue with its normal,
non-shared-memory path. However, the image variable, which was previously set to
NULL, now points to an already-destroyed surface, causing a double-free when the
function cleans up after itself (actually, its an assertion failure because the
reference count of the surface is zero, but technically this is still a double
free).
Fix this by setting image=NULL after destroying the surface that this refers to,
to make sure this surface will not be destroyed again.
While we are here (multiple changes in a single commit are bad...), also fix the
cleanup done in bail. In practice, &image->base should be safe when image==NULL,
because this just adds some offset to the pointer (the offset here is actually
zero, so this doesn't do anything at all). However, the C standard does not
require this to be safe, so let's handle this case specially.
Note that anything that is fixed by this change is still buggy, because the only
reason why XShmGetImage() could fail would be BadDrawable, meaning that the
target we draw to does not exist or was already destroyed. This patch will
likely just cause X11 errors elsewhere and drawing to (possible) invalid
drawables is not supported by cairo anyway. This means that if SHM fails, the
following fallback code has a high chance of failing, too.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=91967
Signed-off-by: Uli Schlachter <psychon@znc.in>
Fixes regression exposed by
commit a73e7ff018
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Sun Jan 6 11:29:27 2013 +0000
xlib: Simplify source creation by use of map-to-image
but ultimately from
commit 74941f8220
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Wed Jan 2 22:27:55 2013 +0000
xlib: Use SHM transport for ordinary image uploads
Reported-by: Gökçen Eraslan <gokcen.eraslan@gmail.com>
Reported-by: Guillaume Ayoub <guillaume.ayoub@kozea.fr>
Reported-by: Emmanuel Benisty <benisty.e@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=59635
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
In theory this should just save a single copy, however PutImage will
break up requests into a series of scanlines requests which is less
efficient than the single-shot transfer provided by ShmPutImage.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
As our lazy event mechanism is sufficient for tracking when to reuse shm
memory, and the events are not necessary for ShmPut/ShmGetImage paths.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Whenever we discard the fallback surface, we need to destroy the
associated damage tracking, so move this into the common discard
routine.
This should fix the issue when trying to flush the fallback before
the user modifies any foreign Drawables. The current code issued the
flush and then explicitly discard the fallback, but unless it was idle
at the time of the flush the associated damage would not have also been
destroyed. Asserts followed.
References: https://bugs.freedesktop.org/show_bug.cgi?id=54657
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Use the higher level layer to be sure we detach any snapshots and other
cached data that is invalidated along with the change of Drawable.
Pointed out by the eternally wise Uli Schlachter.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
_cairo_surface_begin_modification() performs an internal flush, for
which the xlib backend skips flushing the fallback surface as it will
continue to use it for the subsequent operation. In the case where we
are flushing prior to updating the Drawable, we need to perform an
external flush which will trigger the posting of the damage from the
fallback surface.
Reported-by: Weng Xuetian <wengxt@gmail.com>
References: https://bugs.freedesktop.org/show_bug.cgi?id=54657
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
If the user changes the size of the underlying drawable, we much make
sure that we discard the current ShmPixmap in order to create a new
fallback pixmap of the correct size next time.
Reported-by: Weng Xuetian <wengxt@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
In commit 0bfd2acd35
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Mon Aug 13 01:34:12 2012 +0100
xlib: Implement SHM fallbacks and fast upload paths
I made the mistake of inverting the logic for
cairo_xlib_surface_set_drawable() causing it then to never update.
Thanks to Uli Schlachter for spotting my error.
References: https://bugs.freedesktop.org/show_bug.cgi?id=54657
Reported-by: Weng Xuetian <wengxt@gmail.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
In this case we want to prevent the short-circuiting of the flush of the
ShmPixmap that is ordinarily performed during finish().
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reduce the number of copies required for uploading large image data.
Ultimately we want the client to allocate the similar-image itself to
acheive zero copy, this is just an intermediate step for legacy clients.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
We want to avoid unnecessary readback and so only want to use the
ShmPixmap when uploading the complete surface.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Although 0x0 is not a legimate surface size, we do allow applications
the flexibility to reset the size before drawing. As we previously never
checked the size against minimum legal constraints, applications expect
to be able to create seemingly illegal surfaces, and so we must continue
to provide backwards compatibility.
Many thanks to Pauli Nieminen for trawling through the protocol traces,
diving into the depths of libreoffice and identifying the regression.
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=49118 (presentation
mode in loimpress is blank).
Reported-by: Eric Valette <eric.valette@free.fr>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
The Title: field is used to determine the file name of the generated
html. Due to the slash a subdirectory is created and all relative links
in the generated file are broken.
Use a hyphen instead.
Signed-off-by: Uli Schlachter <psychon@znc.in>
The following Python script was used to compute "Since: 1.X" tags,
based on the first version where a symbol became officially supported.
This script requires a concatenation of the the cairo public headers
for the officially supported beckends to be available as
"../../includes/1.X.0.h".
from sys import argv
import re
syms = {}
def stripcomments(text):
def replacer(match):
s = match.group(0)
if s.startswith('/'):
return ""
else:
return s
pattern = re.compile(
r'//.*?$|/\*.*?\*/|\'(?:\\.|[^\\\'])*\'|"(?:\\.|[^\\"])*"',
re.DOTALL | re.MULTILINE
)
return re.sub(pattern, replacer, text)
for minor in range(12,-2,-2):
version = "1.%d" % minor
names = re.split('([A-Za-z0-9_]+)', stripcomments(open("../../includes/%s.0.h" % version).read()))
for s in names: syms[s] = version
for filename in argv[1:]:
is_public = False
lines = open(filename, "r").read().split("\n")
newlines = []
for i in range(len(lines)):
if lines[i] == "/**":
last_sym = lines[i+1][2:].strip().replace(":", "")
is_public = last_sym.lower().startswith("cairo")
elif is_public and lines[i] == " **/":
if last_sym in syms:
v = syms[last_sym]
if re.search("Since", newlines[-1]): newlines = newlines[:-1]
if newlines[-1].strip() != "*": newlines.append(" *")
newlines.append(" * Since: %s" % v)
else:
print "%s (%d): Cannot determine the version in which '%s' was introduced" % (filename, i, last_sym)
newlines.append(lines[i])
out = open(filename, "w")
out.write("\n".join(newlines))
out.close()
Documentation comments should always start with "/**" and end with
"**/". This is not required by gtk-doc, but it makes the
documentations formatting more consistent and simplifies the checking
of documentation comments.
The following Python script tries to enforce this.
from sys import argv
from sre import search
for filename in argv[1:]:
in_doc = False
lines = open(filename, "r").read().split("\n")
for i in range(len(lines)):
ls = lines[i].strip()
if ls == "/**":
in_doc = True
elif in_doc and ls == "*/":
lines[i] = " **/"
if ls.endswith("*/"):
in_doc = False
out = open(filename, "w")
out.write("\n".join(lines))
out.close()
This fixes most 'documentation comment not closed with **/' warnings
by check-doc-syntax.awk.
For a foreign drawable, we have to assume to that is dirty upon creation
or otherwise we fail to read back the correct pixel data when copying to
an image.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
If we need to fallback and perform a copy first to a pixmap for a
partially unviewable Window, we need to copy its inferiors as well.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
The only reliable method would be to query the xserver for the
matching bpp for a particular depth. In the absence of such information,
simply chose the next higher power-of-two(depth).
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Having spent the last dev cycle looking at how we could specialize the
compositors for various backends, we once again look for the
commonalities in order to reduce the duplication. In part this is
motivated by the idea that spans is a good interface for both the
existent GL backend and pixman, and so they deserve a dedicated
compositor. xcb/xlib target an identical rendering system and so they
should be using the same compositor, and it should be possible to run
that same compositor locally against pixman to generate reference tests.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
P.S. This brings massive upheaval (read breakage) I've tried delaying in
order to fix as many things as possible but now this one patch does far,
far, far too much. Apologies in advance for breaking your favourite
backend, but trust me in that the end result will be much better. :)
The existing API only described the method to be used for performing
rasterisation and unlike other API provided no opportunity for the user
to give a hint as to how to trade off performance against speed. So in
order to no be overly prescriptive, we extend the NONE/GRAY/SUBPIXEL
methods with FAST/GOOD/BEST hints and leave the backend to decide how
best to achieve those goals.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
