Use _cairo_malloc instead of malloc

_cairo_malloc(0) always returns NULL, but has not been used
consistently.  This patch replaces many calls to malloc() with
_cairo_malloc().

Fixes:  fdo# 101547
CVE: CVE-2017-9814 Heap buffer overflow at cairo-truetype-subset.c:1299
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>

1 files changed, 4 insertions, 4 deletions

diff --git a/src/cairo-clip.c b/src/cairo-clip.c
index 0df9b06bf..d499bf0ad 100644
--- a/src/cairo-clip.c
+++ b/src/cairo-clip.c
@@ -62,7 +62,7 @@ _cairo_clip_path_create (cairo_clip_t *clip)
 
     clip_path = _freed_pool_get (&clip_path_pool);
     if (unlikely (clip_path == NULL)) {
-	clip_path = malloc (sizeof (cairo_clip_path_t));
+	clip_path = _cairo_malloc (sizeof (cairo_clip_path_t));
 	if (unlikely (clip_path == NULL))
 	    return NULL;
     }
@@ -108,7 +108,7 @@ _cairo_clip_create (void)
 
     clip = _freed_pool_get (&clip_pool);
     if (unlikely (clip == NULL)) {
-	clip = malloc (sizeof (cairo_clip_t));
+	clip = _cairo_malloc (sizeof (cairo_clip_t));
 	if (unlikely (clip == NULL))
 	    return NULL;
     }
@@ -735,7 +735,7 @@ _cairo_rectangle_list_create_in_error (cairo_status_t status)
     if (status == CAIRO_STATUS_CLIP_NOT_REPRESENTABLE)
 	return (cairo_rectangle_list_t*) &_cairo_rectangles_not_representable;
 
-    list = malloc (sizeof (*list));
+    list = _cairo_malloc (sizeof (*list));
     if (unlikely (list == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_rectangle_list_t*) &_cairo_rectangles_nil;
@@ -795,7 +795,7 @@ _cairo_clip_copy_rectangle_list (cairo_clip_t *clip, cairo_gstate_t *gstate)
     }
 
  DONE:
-    list = malloc (sizeof (cairo_rectangle_list_t));
+    list = _cairo_malloc (sizeof (cairo_rectangle_list_t));
     if (unlikely (list == NULL)) {
         free (rectangles);
 	return ERROR_LIST (CAIRO_STATUS_NO_MEMORY);