Update to 1.14.2

This commit is contained in:
Kalev Lember 2015-03-11 14:27:05 +01:00
parent fe9e8db9f7
commit b83c5b6641
6 changed files with 7 additions and 132 deletions

1
.gitignore vendored
View File

@ -12,3 +12,4 @@ cairo-1.9.14.tar.gz
/cairo-1.12.16.tar.xz
/cairo-1.13.1-337ab1f.tar.xz
/cairo-1.14.0.tar.xz
/cairo-1.14.2.tar.xz

View File

@ -1,43 +0,0 @@
From 8dc3b629434ce256f8e6a584c5853ae9b4230c33 Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@redhat.com>
Date: Wed, 31 Oct 2012 16:06:51 -0400
Subject: [PATCH 1/2] xlib: Don't crash when swapping a 0-sized glyph
malloc(0) needn't return NULL, and on glibc, doesn't. Then we encounter
a loop of the form do { ... } while (--c), which doesn't do quite what
you were hoping for when c is initially 0.
Since there's nothing to swap in this case, just bomb out.
Signed-off-by: Adam Jackson <ajax@redhat.com>
---
src/cairo-xlib-render-compositor.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/cairo-xlib-render-compositor.c b/src/cairo-xlib-render-compositor.c
index 74c43e9..e38a659 100644
--- a/src/cairo-xlib-render-compositor.c
+++ b/src/cairo-xlib-render-compositor.c
@@ -1251,6 +1251,9 @@ _cairo_xlib_surface_add_glyph (cairo_xlib_display_t *display,
unsigned char *d;
unsigned char *new, *n;
+ if (c == 0)
+ break;
+
new = malloc (c);
if (!new) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
@@ -1276,6 +1279,9 @@ _cairo_xlib_surface_add_glyph (cairo_xlib_display_t *display,
const uint32_t *d;
uint32_t *new, *n;
+ if (c == 0)
+ break;
+
new = malloc (4 * c);
if (unlikely (new == NULL)) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
--
1.7.12.1

View File

@ -1,43 +0,0 @@
From 4cad9bf9f0744efe17f1b70548cd2059df071e81 Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@redhat.com>
Date: Wed, 31 Oct 2012 16:12:58 -0400
Subject: [PATCH 2/2] xcb: Don't crash when swapping a 0-sized glyph
malloc(0) needn't return NULL, and on glibc, doesn't. Then we encounter
a loop of the form do { ... } while (--c), which doesn't do quite what
you were hoping for when c is initially 0.
Since there's nothing to swap in this case, just bomb out.
Signed-off-by: Adam Jackson <ajax@redhat.com>
---
src/cairo-xcb-surface-render.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/cairo-xcb-surface-render.c b/src/cairo-xcb-surface-render.c
index 27ed113..16d1ef8 100644
--- a/src/cairo-xcb-surface-render.c
+++ b/src/cairo-xcb-surface-render.c
@@ -4461,6 +4461,9 @@ _cairo_xcb_surface_add_glyph (cairo_xcb_connection_t *connection,
const uint8_t *d;
uint8_t *new, *n;
+ if (c == 0)
+ break;
+
new = malloc (c);
if (unlikely (new == NULL)) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
@@ -4489,6 +4492,9 @@ _cairo_xcb_surface_add_glyph (cairo_xcb_connection_t *connection,
const uint32_t *d;
uint32_t *new, *n;
+ if (c == 0)
+ break;
+
new = malloc (4 * c);
if (unlikely (new == NULL)) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
--
1.7.12.1

View File

@ -1,32 +0,0 @@
From 5c82d91a5e15d29b1489dcb413b24ee7fdf59934 Mon Sep 17 00:00:00 2001
From: Bryce Harrington <bryce@osg.samsung.com>
Date: Wed, 3 Dec 2014 19:28:15 -0800
Subject: image: Fix crash in _fill_xrgb32_lerp_opaque_spans
If a span length is negative don't go out of bounds processing the fill
data.
Patch thanks to Ilya Sakhnenko <ilia.softway@gmail.com> on mailing list.
Signed-off-by: Bryce Harrington <bryce@osg.samsung.com>
diff --git a/src/cairo-image-compositor.c b/src/cairo-image-compositor.c
index 6ff0f09..48072f8 100644
--- a/src/cairo-image-compositor.c
+++ b/src/cairo-image-compositor.c
@@ -2242,10 +2242,10 @@ _fill_xrgb32_lerp_opaque_spans (void *abstract_renderer, int y, int h,
spans[0].x, y, len, 1, r->u.fill.pixel);
} else {
uint32_t *d = (uint32_t*)(r->u.fill.data + r->u.fill.stride*y + spans[0].x*4);
- while (len--)
+ while (len-- > 0)
*d++ = r->u.fill.pixel;
}
- } else while (len--) {
+ } else while (len-- > 0) {
*d = lerp8x4 (r->u.fill.pixel, a, *d);
d++;
}
--
cgit v0.10.2

View File

@ -4,22 +4,14 @@
Summary: A 2D graphics library
Name: cairo
Version: 1.14.0
Release: 3%{?dist}
Version: 1.14.2
Release: 1%{?dist}
URL: http://cairographics.org
Source0: http://cairographics.org/releases/%{name}-%{version}.tar.xz
License: LGPLv2 or MPLv1.1
Group: System Environment/Libraries
Patch0: 0001-xlib-Don-t-crash-when-swapping-a-0-sized-glyph.patch
Patch1: 0002-xcb-Don-t-crash-when-swapping-a-0-sized-glyph.patch
Patch3: cairo-multilib.patch
#
# Fix for dot crashes
# https://bugzilla.redhat.com/show_bug.cgi?id=1183242
# Already upstreamed:
# http://cgit.freedesktop.org/cairo/patch/src/cairo-image-compositor.c?id=5c82d91a5e15d29b1489dcb413b24ee7fdf59934
Patch4: cairo-fix_crash_in_fill_xrgb32_lerp_opaque_spans.patch
BuildRequires: pkgconfig
BuildRequires: libXrender-devel
@ -94,10 +86,7 @@ This package contains tools for working with the cairo graphics library.
%prep
%setup -q
%patch0 -p1 -b .xlib-swap
%patch1 -p1 -b .xcb-swap
%patch3 -p1 -b .multilib
%patch4 -p1
%build
%configure --disable-static \
@ -181,6 +170,9 @@ rm $RPM_BUILD_ROOT%{_libdir}/*.la
%{_libdir}/cairo/
%changelog
* Wed Mar 11 2015 Kalev Lember <kalevlember@gmail.com> - 1.14.2-1
- Update to 1.14.2
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 1.14.0-3
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code

View File

@ -1 +1 @@
fc3a5edeba703f906f2241b394f0cced cairo-1.14.0.tar.xz
e1cdfaf1c6c995c4d4c54e07215b0118 cairo-1.14.2.tar.xz