libs/cairo/patches/004-fix-mask-usage-in-image-compositor.patch

   1 From 03a820b173ed1fdef6ff14b4468f5dbc02ff59be Mon Sep 17 00:00:00 2001
   2 From: Heiko Lewin <heiko.lewin@worldiety.de>
   3 Date: Tue, 15 Dec 2020 16:48:19 +0100
   4 Subject: [PATCH 1/3] Fix mask usage in image-compositor
   5
   6 ---
   7  src/cairo-image-compositor.c                |   8 ++--
   8  test/Makefile.sources                       |   1 +
   9  test/bug-image-compositor.c                 |  39 ++++++++++++++++++++
  10  test/reference/bug-image-compositor.ref.png | Bin 0 -> 185 bytes
  11  4 files changed, 44 insertions(+), 4 deletions(-)
  12  create mode 100644 test/bug-image-compositor.c
  13  create mode 100644 test/reference/bug-image-compositor.ref.png
  14
  15 --- a/src/cairo-image-compositor.c
  16 +++ b/src/cairo-image-compositor.c
  17 @@ -2601,14 +2601,14 @@ _inplace_src_spans (void *abstract_rende
  18                     unsigned num_spans)
  19  {
  20      cairo_image_span_renderer_t *r = abstract_renderer;
  21 -    uint8_t *m;
  22 +    uint8_t *m, *base = (uint8_t*)pixman_image_get_data(r->mask);
  23      int x0;
  24
  25      if (num_spans == 0)
  26         return CAIRO_STATUS_SUCCESS;
  27
  28      x0 = spans[0].x;
  29 -    m = r->_buf;
  30 +    m = base;
  31      do {
  32         int len = spans[1].x - spans[0].x;
  33         if (len >= r->u.composite.run_length && spans[0].coverage == 0xff) {
  34 @@ -2646,7 +2646,7 @@ _inplace_src_spans (void *abstract_rende
  35                                       spans[0].x, y,
  36                                       spans[1].x - spans[0].x, h);
  37
  38 -           m = r->_buf;
  39 +           m = base;
  40             x0 = spans[1].x;
  41         } else if (spans[0].coverage == 0x0) {
  42             if (spans[0].x != x0) {
  43 @@ -2675,7 +2675,7 @@ _inplace_src_spans (void *abstract_rende
  44  #endif
  45             }
  46
  47 -           m = r->_buf;
  48 +           m = base;
  49             x0 = spans[1].x;
  50         } else {
  51             *m++ = spans[0].coverage;
  52 --- /dev/null
  53 +++ b/test/bug-image-compositor.c
  54 @@ -0,0 +1,66 @@
  55 +/*
  56 + * Copyright © 2020 Uli Schlachter, Heiko Lewin
  57 + *
  58 + * Permission is hereby granted, free of charge, to any person
  59 + * obtaining a copy of this software and associated documentation
  60 + * files (the "Software"), to deal in the Software without
  61 + * restriction, including without limitation the rights to use, copy,
  62 + * modify, merge, publish, distribute, sublicense, and/or sell copies
  63 + * of the Software, and to permit persons to whom the Software is
  64 + * furnished to do so, subject to the following conditions:
  65 + *
  66 + * The above copyright notice and this permission notice shall be
  67 + * included in all copies or substantial portions of the Software.
  68 + *
  69 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  70 + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  71 + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  72 + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  73 + * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  74 + * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  75 + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  76 + * SOFTWARE.
  77 + *
  78 + * Author: Uli Schlachter <psychon@znc.in>
  79 + * Author: Heiko Lewin <hlewin@gmx.de>
  80 + */
  81 +#include "cairo-test.h"
  82 +
  83 +
  84 +/* This test reproduces an overflow of a mask-buffer in cairo-image-compositor.c */
  85 +
  86 +static cairo_test_status_t
  87 +draw (cairo_t *cr, int width, int height)
  88 +{
  89 +    cairo_set_source_rgb (cr, 0., 0., 0.);
  90 +    cairo_paint (cr);
  91 +
  92 +    cairo_set_source_rgb (cr, 1., 1., 1.);
  93 +    cairo_set_line_width (cr, 1.);
  94 +
  95 +    cairo_pattern_t *p = cairo_pattern_create_linear (0, 0, width, height);
  96 +    cairo_pattern_add_color_stop_rgb (p, 0, 0.99, 1, 1);
  97 +    cairo_pattern_add_color_stop_rgb (p, 1, 1, 1, 1);
  98 +    cairo_set_source (cr, p);
  99 +    cairo_pattern_destroy(p);
 100 +
 101 +    cairo_move_to (cr, 0.5, -1);
 102 +    for (int i = 0; i < width; i+=3) {
 103 +       cairo_rel_line_to (cr, 2, 2);
 104 +       cairo_rel_line_to (cr, 1, -2);
 105 +    }
 106 +
 107 +    cairo_set_operator (cr, CAIRO_OPERATOR_SOURCE);
 108 +    cairo_stroke (cr);
 109 +
 110 +    return CAIRO_TEST_SUCCESS;
 111 +}
 112 +
 113 +
 114 +CAIRO_TEST (bug_image_compositor,
 115 +           "Crash in image-compositor",
 116 +           "stroke, stress", /* keywords */
 117 +           NULL, /* requirements */
 118 +           10000, 1,
 119 +           NULL, draw)
 120 +