Attachment 18378 Details for Bug 17201 – Fix memleak and invalid free

[patch] Fix memleak and invalid free

0001-CairoOutputDev-Memleak-and-invalid-free.patch (text/plain), 2.20 KB, created by Chris Wilson on 2008-08-19 03:41:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Wilson

Created: 2008-08-19 03:41:55 UTC

Size: 2.20 KB

patch

obsolete

>From 0d3ebb9d063c69e65c4ac8d5d790f5c576ae9e33 Mon Sep 17 00:00:00 2001
>From: Chris Wilson <chris@chris-wilson.co.uk>
>Date: Tue, 19 Aug 2008 09:18:03 +0100
>Subject: [PATCH] [CairoOutputDev] Memleak and invalid free.
>
>CairoOutputDev::setSoftMask() fails to free the cairo_t and mask it uses
>to draw the opaque soft mask and attempts to destroy a reference to a
>surface it does not own (this bug was masked by the fact that a reference
>was still being held by the unfreed cairo_t).
>---
> poppler/CairoOutputDev.cc |   11 ++++++++---
> 1 files changed, 8 insertions(+), 3 deletions(-)
>
>diff --git a/poppler/CairoOutputDev.cc b/poppler/CairoOutputDev.cc
>index 6d4267e..907bac8 100644
>--- a/poppler/CairoOutputDev.cc
>+++ b/poppler/CairoOutputDev.cc
>@@ -122,6 +122,8 @@ CairoOutputDev::~CairoOutputDev() {
>   cairo_pattern_destroy (fill_pattern);
>   if (group)
>     cairo_pattern_destroy (group);
>+  if (mask)
>+    cairo_pattern_destroy (mask);
>   if (shape)
>     cairo_pattern_destroy (shape);
> }
>@@ -821,6 +823,8 @@ static uint32_t luminocity(uint32_t x)
> /* XXX: do we need to deal with shape here? */
> void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha,
>                                  Function * transferFunc, GfxColor * backdropColor) {
>+  cairo_pattern_destroy(mask);
>+
>   if (alpha == false) {
>     /* We need to mask according to the luminocity of the group.
>      * So we paint the group to an image surface convert it to a luminocity map
>@@ -858,6 +862,9 @@ void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha,
>     cairo_set_source(maskCtx, group);
>     cairo_paint(maskCtx);
> 
>+    /* XXX status = cairo_status(maskCtx); */
>+    cairo_destroy(maskCtx);
>+
>     /* convert to a luminocity map */
>     uint32_t *source_data = (uint32_t*)cairo_image_surface_get_data(source);
>     /* get stride in units of 32 bits */
>@@ -887,10 +894,8 @@ void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha,
>     cairo_pattern_set_matrix(mask, &patMatrix);
> 
>     cairo_surface_destroy(source);
>-    cairo_surface_destroy(pats);
>   } else {
>-    cairo_pattern_reference(group);
>-    mask = group;
>+    mask = cairo_pattern_reference(group);
>   }
> 
>   popTransparencyGroup();
>-- 
>1.5.4.3
>

Actions: View | Splinter Review

Attachments on bug 17201: 18378

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.