From 0d3ebb9d063c69e65c4ac8d5d790f5c576ae9e33 Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Tue, 19 Aug 2008 09:18:03 +0100 Subject: [PATCH] [CairoOutputDev] Memleak and invalid free. CairoOutputDev::setSoftMask() fails to free the cairo_t and mask it uses to draw the opaque soft mask and attempts to destroy a reference to a surface it does not own (this bug was masked by the fact that a reference was still being held by the unfreed cairo_t). --- poppler/CairoOutputDev.cc | 11 ++++++++--- 1 files changed, 8 insertions(+), 3 deletions(-) diff --git a/poppler/CairoOutputDev.cc b/poppler/CairoOutputDev.cc index 6d4267e..907bac8 100644 --- a/poppler/CairoOutputDev.cc +++ b/poppler/CairoOutputDev.cc @@ -122,6 +122,8 @@ CairoOutputDev::~CairoOutputDev() { cairo_pattern_destroy (fill_pattern); if (group) cairo_pattern_destroy (group); + if (mask) + cairo_pattern_destroy (mask); if (shape) cairo_pattern_destroy (shape); } @@ -821,6 +823,8 @@ static uint32_t luminocity(uint32_t x) /* XXX: do we need to deal with shape here? */ void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha, Function * transferFunc, GfxColor * backdropColor) { + cairo_pattern_destroy(mask); + if (alpha == false) { /* We need to mask according to the luminocity of the group. * So we paint the group to an image surface convert it to a luminocity map @@ -858,6 +862,9 @@ void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha, cairo_set_source(maskCtx, group); cairo_paint(maskCtx); + /* XXX status = cairo_status(maskCtx); */ + cairo_destroy(maskCtx); + /* convert to a luminocity map */ uint32_t *source_data = (uint32_t*)cairo_image_surface_get_data(source); /* get stride in units of 32 bits */ @@ -887,10 +894,8 @@ void CairoOutputDev::setSoftMask(GfxState * state, double * bbox, GBool alpha, cairo_pattern_set_matrix(mask, &patMatrix); cairo_surface_destroy(source); - cairo_surface_destroy(pats); } else { - cairo_pattern_reference(group); - mask = group; + mask = cairo_pattern_reference(group); } popTransparencyGroup(); -- 1.5.4.3