Bug 6197 - Null pointer dereference on OOM in _clip_and_composite_trapezoids()
Summary: Null pointer dereference on OOM in _clip_and_composite_trapezoids()
Alias: None
Product: cairo
Classification: Unclassified
Component: general (show other bugs)
Version: 1.1.1
Hardware: PowerPC Mac OS X (All)
: high normal
Assignee: Carl Worth
QA Contact: cairo-bugs mailing list
URL: http://gitweb.freedesktop.org/?p=cair...
Depends on:
Reported: 2006-03-10 04:49 UTC by timeless
Modified: 2007-01-23 20:00 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Description timeless 2006-03-10 04:49:50 UTC
This was found through a coverity scan of the mozilla source; see

See |_clip_and_composite_trapezoids| in cairo-surface-fallback.c. If
|_cairo_region_create_from_rectangle| returns NULL, it's dereferenced under the call to  
_cairo_clip_intersect_to_region which chains to pixman_region_intersect.
Comment 1 Carl Worth 2006-03-14 07:32:29 UTC
This is now fixed in cairo 1.1.1 and 1.0.3.


diff-tree 6f0d8eedc504e8af2224c502be25dc82b5df70f4 (from
Author: Carl Worth <cworth@cworth.org>
Date:   Mon Mar 13 12:25:25 2006 -0800

    _clip_and_composite_trapezoids: Avoid NULL pointer dereference due to OOM.

    This closes bug #6197:

        Null pointer dereference on OOM in _clip_and_composite_trapezoids()

diff --git a/src/cairo-surface-fallback.c b/src/cairo-surface-fallback.c
index 9dde31f..9b6cfd6 100644
--- a/src/cairo-surface-fallback.c
+++ b/src/cairo-surface-fallback.c
@@ -549,6 +549,9 @@ _clip_and_composite_trapezoids (cairo_pa
                return status;

            clear_region = _cairo_region_create_from_rectangle (&extents);
+           if (clear_region == NULL)
+               return CAIRO_STATUS_NO_MEMORY;
            status = _cairo_clip_intersect_to_region (clip, clear_region);
            if (status)
                return status;
Comment 2 Carl Worth 2006-03-14 07:36:21 UTC
...and marked as resolved.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.