| From 03a820b173ed1fdef6ff14b4468f5dbc02ff59be Mon Sep 17 00:00:00 2001 |
| From: Heiko Lewin <heiko.lewin@worldiety.de> |
| Date: Tue, 15 Dec 2020 16:48:19 +0100 |
| Subject: [PATCH] Fix mask usage in image-compositor |
| |
| CVE: CVE-2020-35492 |
| |
| Upstream-Status: Backport [https://gitlab.freedesktop.org/cairo/cairo/-/commit/03a820b173ed1fdef6ff14b4468f5dbc02ff59be?merge_request_iid=85] |
| |
| original patch from upstream has a binary file, it will cause |
| do_patch failed with "git binary diffs are not supported". |
| |
| so add do_patch_append in recipe to add this binary source. when removing |
| this patch, please also remove do_patch_append for this patch |
| |
| Signed-off-by: Changqing Li <changqing.li@windriver.com> |
| --- |
| src/cairo-image-compositor.c | 8 ++-- |
| test/Makefile.sources | 1 + |
| test/bug-image-compositor.c | 39 ++++++++++++++++++++ |
| 3 files changed, 44 insertions(+), 4 deletions(-) |
| create mode 100644 test/bug-image-compositor.c |
| |
| diff --git a/src/cairo-image-compositor.c b/src/cairo-image-compositor.c |
| index 79ad69f68..4f8aaed99 100644 |
| --- a/src/cairo-image-compositor.c |
| +++ b/src/cairo-image-compositor.c |
| @@ -2610,14 +2610,14 @@ _inplace_src_spans (void *abstract_renderer, int y, int h, |
| unsigned num_spans) |
| { |
| cairo_image_span_renderer_t *r = abstract_renderer; |
| - uint8_t *m; |
| + uint8_t *m, *base = (uint8_t*)pixman_image_get_data(r->mask); |
| int x0; |
| |
| if (num_spans == 0) |
| return CAIRO_STATUS_SUCCESS; |
| |
| x0 = spans[0].x; |
| - m = r->_buf; |
| + m = base; |
| do { |
| int len = spans[1].x - spans[0].x; |
| if (len >= r->u.composite.run_length && spans[0].coverage == 0xff) { |
| @@ -2655,7 +2655,7 @@ _inplace_src_spans (void *abstract_renderer, int y, int h, |
| spans[0].x, y, |
| spans[1].x - spans[0].x, h); |
| |
| - m = r->_buf; |
| + m = base; |
| x0 = spans[1].x; |
| } else if (spans[0].coverage == 0x0) { |
| if (spans[0].x != x0) { |
| @@ -2684,7 +2684,7 @@ _inplace_src_spans (void *abstract_renderer, int y, int h, |
| #endif |
| } |
| |
| - m = r->_buf; |
| + m = base; |
| x0 = spans[1].x; |
| } else { |
| *m++ = spans[0].coverage; |
| diff --git a/test/Makefile.sources b/test/Makefile.sources |
| index 7eb73647f..86494348d 100644 |
| --- a/test/Makefile.sources |
| +++ b/test/Makefile.sources |
| @@ -34,6 +34,7 @@ test_sources = \ |
| bug-source-cu.c \ |
| bug-extents.c \ |
| bug-seams.c \ |
| + bug-image-compositor.c \ |
| caps.c \ |
| checkerboard.c \ |
| caps-joins.c \ |
| diff --git a/test/bug-image-compositor.c b/test/bug-image-compositor.c |
| new file mode 100644 |
| index 000000000..fc4fd370b |
| --- /dev/null |
| +++ b/test/bug-image-compositor.c |
| @@ -0,0 +1,39 @@ |
| +#include "cairo-test.h" |
| + |
| +static cairo_test_status_t |
| +draw (cairo_t *cr, int width, int height) |
| +{ |
| + cairo_set_source_rgb (cr, 0., 0., 0.); |
| + cairo_paint (cr); |
| + |
| + cairo_set_source_rgb (cr, 1., 1., 1.); |
| + cairo_set_line_width (cr, 1.); |
| + |
| + cairo_pattern_t *p = cairo_pattern_create_linear (0, 0, width, height); |
| + cairo_pattern_add_color_stop_rgb (p, 0, 0.99, 1, 1); |
| + cairo_pattern_add_color_stop_rgb (p, 1, 1, 1, 1); |
| + cairo_set_source (cr, p); |
| + |
| + cairo_move_to (cr, 0.5, -1); |
| + for (int i = 0; i < width; i+=3) { |
| + cairo_rel_line_to (cr, 2, 2); |
| + cairo_rel_line_to (cr, 1, -2); |
| + } |
| + |
| + cairo_set_operator (cr, CAIRO_OPERATOR_SOURCE); |
| + cairo_stroke (cr); |
| + |
| + cairo_pattern_destroy(p); |
| + |
| + return CAIRO_TEST_SUCCESS; |
| +} |
| + |
| + |
| +CAIRO_TEST (bug_image_compositor, |
| + "Crash in image-compositor", |
| + "stroke, stress", /* keywords */ |
| + NULL, /* requirements */ |
| + 10000, 1, |
| + NULL, draw) |
| + |
| + |
| -- |
| GitLab |