diff options
| author | Uli Schlachter <psychon@znc.in> | 2020-12-26 16:17:58 +0100 |
|---|---|---|
| committer | Uli Schlachter <psychon@znc.in> | 2020-12-26 19:11:31 +0100 |
| commit | a1dc600a07f89b9c08ffa8c25dc92f75fec10dd6 (patch) | |
| tree | a2150dd1dc43cdba5bdd00e0c79d4f856398f701 /src/cairo-recording-surface.c | |
| parent | 979382dd302bbab73d8c81740ddd72afc31a8ea8 (diff) | |
| download | cairo-a1dc600a07f89b9c08ffa8c25dc92f75fec10dd6.tar.gz | |
Fix copying tags in a recording surface
The code was copying from the wrong member of an union. This caused a
huge num_dashes value to be read, which then caused a so large memory
allocation that malloc returned an error.
Fixes: https://gitlab.freedesktop.org/cairo/cairo/-/issues/448
Signed-off-by: Uli Schlachter <psychon@znc.in>
Diffstat (limited to 'src/cairo-recording-surface.c')
| -rw-r--r-- | src/cairo-recording-surface.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/cairo-recording-surface.c b/src/cairo-recording-surface.c index 6df8b0821..393eecca5 100644 --- a/src/cairo-recording-surface.c +++ b/src/cairo-recording-surface.c @@ -1456,17 +1456,17 @@ _cairo_recording_surface_copy__tag (cairo_recording_surface_t *surface, command->attributes = strdup (src->tag.attributes); status = _cairo_pattern_init_copy (&command->source.base, - &src->stroke.source.base); + &src->tag.source.base); if (unlikely (status)) goto err_command; status = _cairo_stroke_style_init_copy (&command->style, - &src->stroke.style); + &src->tag.style); if (unlikely (status)) goto err_source; - command->ctm = src->stroke.ctm; - command->ctm_inverse = src->stroke.ctm_inverse; + command->ctm = src->tag.ctm; + command->ctm_inverse = src->tag.ctm_inverse; } status = _cairo_recording_surface_commit (surface, &command->header); |