Bug 75819

This bug was originally filed as part of poppler, but it seems to be a cairo 
issue: https://bugs.freedesktop.org/show_bug.cgi?id=74661

Here are the relevant code snippets:

>>>> cairo-clip.c: (on some platforms, this will be allocated to a read-only page of memory)

const cairo_clip_t __cairo_clip_all;


>>>> cairo-clip-inline.h: (returning __cairo_clip_all as non-const! uh oh...)

static inline cairo_clip_t *                                                                                                                                                                                  
_cairo_clip_set_all_clipped (cairo_clip_t *clip)                                                                                                                                                              
{                                                                                                                                                                                                             
    _cairo_clip_destroy (clip);                                                                                                                                                                               
    return (cairo_clip_t *) &__cairo_clip_all;                                                                                                                                                                
}                                                                                                                                                                                                             


>>>> cairo-clip-boxes.c: (mutate __cairo_clip_all -> CRASH!)

static cairo_clip_t *                                                                                                                                                                                         
_cairo_clip_intersect_rectangle_box (cairo_clip_t *clip,                                                                                                                                                      
                                     const cairo_rectangle_int_t *r,                                                                                                                                          
                                     const cairo_box_t *box)                                                                                                                                                  
{
...
                clip = _cairo_clip_set_all_clipped (clip);                                                                                                                                                    
...
            clip->is_region = _cairo_box_is_pixel_aligned (box);
            ^^^^^^^^^^^^^^^ bad write
...
}

I'm not a cairo expert by any stretch of the imagination, so I don't know the solution here. My gut reaction is to make the memory non-const so that it doesn't crash; that should at least work as well as systems where this doesn't crash. Still, it seems like someone who knows this code could see if there's a better solution.

Thanks,
-andrew