Merge branch 'invalid-free-crash' of gitlab.freedesktop.org:psychon/cairo

1 files changed, 15 insertions, 2 deletions

diff --git a/src/cairo-clip-inline.h b/src/cairo-clip-inline.h
index a9f232692..d52afd313 100644
--- a/src/cairo-clip-inline.h
+++ b/src/cairo-clip-inline.h
@@ -68,7 +68,14 @@ _cairo_clip_copy_intersect_clip (const cairo_clip_t *clip,
 static inline void
 _cairo_clip_steal_boxes (cairo_clip_t *clip, cairo_boxes_t *boxes)
 {
-    _cairo_boxes_init_for_array (boxes, clip->boxes, clip->num_boxes);
+    cairo_box_t *array = clip->boxes;
+
+    if (array == &clip->embedded_box) {
+	assert (clip->num_boxes == 1);
+	boxes->boxes_embedded[0] = clip->embedded_box;
+	array = &boxes->boxes_embedded[0];
+    }
+    _cairo_boxes_init_for_array (boxes, array, clip->num_boxes);
     clip->boxes = NULL;
     clip->num_boxes = 0;
 }
@@ -76,7 +83,13 @@ _cairo_clip_steal_boxes (cairo_clip_t *clip, cairo_boxes_t *boxes)
 static inline void
 _cairo_clip_unsteal_boxes (cairo_clip_t *clip, cairo_boxes_t *boxes)
 {
-    clip->boxes = boxes->chunks.base;
+    if (boxes->chunks.base == &boxes->boxes_embedded[0]) {
+	assert(boxes->num_boxes == 1);
+	clip->embedded_box = *boxes->chunks.base;
+	clip->boxes = &clip->embedded_box;
+    } else {
+	clip->boxes = boxes->chunks.base;
+    }
     clip->num_boxes = boxes->num_boxes;
 }