summaryrefslogtreecommitdiff
path: root/src/cairo-surface-observer-private.h
diff options
context:
space:
mode:
authorAshim <ashim.shah@samsung.com>2015-07-09 10:43:30 +0530
committerBryce Harrington <bryce@osg.samsung.com>2015-07-09 13:50:35 -0700
commit498fc2fbe31682754f1aa3864b764229d0b6838c (patch)
tree029fcf7cbfa34aa417bc939723be10e8fe0b5862 /src/cairo-surface-observer-private.h
parentad45e8f99f4ab6777559480cede7d1461a9c28fc (diff)
downloadcairo-498fc2fbe31682754f1aa3864b764229d0b6838c.tar.gz
Fix out of bound access in struct pattern->type
The pattern structure is hardcoded to hold 7 elements, yet the pattern_names array in cairo-surface-observer.c is initialized with 8 strings. This causes a crash in print_array at line 1587 when it tries to access the 8th member. Hence changed the 'type' array from type[7] to type[8] to avoid out of bound access. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=91266 Signed-off-by: Ashim <ashim.shah@samsung.com> Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
Diffstat (limited to 'src/cairo-surface-observer-private.h')
-rw-r--r--src/cairo-surface-observer-private.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/cairo-surface-observer-private.h b/src/cairo-surface-observer-private.h
index 70c87db82..6ed0c18d1 100644
--- a/src/cairo-surface-observer-private.h
+++ b/src/cairo-surface-observer-private.h
@@ -62,7 +62,7 @@ struct extents {
};
struct pattern {
- unsigned int type[7]; /* native/record/other surface/gradients */
+ unsigned int type[8]; /* native/record/other surface/gradients */
};
struct path {