diff options
| author | Adrian Johnson <ajohnson@redneon.com> | 2017-07-08 09:28:03 +0930 |
|---|---|---|
| committer | Bryce Harrington <bryce@osg.samsung.com> | 2018-05-07 16:35:51 -0700 |
| commit | 199823938780c8e50099b627d3e9137acba7a263 (patch) | |
| tree | 858c70f2a9c116ed2a5ffcb05cd9d8d3fe18a4cb /src/cairo-xcb-surface-render.c | |
| parent | 7554822dd0b52d33ec7898e81b59e97164b00142 (diff) | |
| download | cairo-199823938780c8e50099b627d3e9137acba7a263.tar.gz | |
Use _cairo_malloc instead of malloc
_cairo_malloc(0) always returns NULL, but has not been used
consistently. This patch replaces many calls to malloc() with
_cairo_malloc().
Fixes: fdo# 101547
CVE: CVE-2017-9814 Heap buffer overflow at cairo-truetype-subset.c:1299
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
Diffstat (limited to 'src/cairo-xcb-surface-render.c')
| -rw-r--r-- | src/cairo-xcb-surface-render.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/src/cairo-xcb-surface-render.c b/src/cairo-xcb-surface-render.c index a4969c957..42f27c71f 100644 --- a/src/cairo-xcb-surface-render.c +++ b/src/cairo-xcb-surface-render.c @@ -114,7 +114,7 @@ _cairo_xcb_picture_create (cairo_xcb_screen_t *screen, { cairo_xcb_picture_t *surface; - surface = malloc (sizeof (cairo_xcb_picture_t)); + surface = _cairo_malloc (sizeof (cairo_xcb_picture_t)); if (unlikely (surface == NULL)) return (cairo_xcb_picture_t *) _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY)); @@ -4141,7 +4141,7 @@ _cairo_xcb_font_create (cairo_xcb_connection_t *connection, cairo_xcb_font_t *priv; int i; - priv = malloc (sizeof (cairo_xcb_font_t)); + priv = _cairo_malloc (sizeof (cairo_xcb_font_t)); if (unlikely (priv == NULL)) return NULL; @@ -4334,7 +4334,7 @@ _cairo_xcb_glyph_fini (cairo_scaled_glyph_private_t *glyph_private, } if (to_free == NULL) { - to_free = malloc (sizeof (cairo_xcb_font_glyphset_free_glyphs_t)); + to_free = _cairo_malloc (sizeof (cairo_xcb_font_glyphset_free_glyphs_t)); if (unlikely (to_free == NULL)) { _cairo_error_throw (CAIRO_STATUS_NO_MEMORY); return; /* XXX cannot propagate failure */ @@ -4361,7 +4361,7 @@ _cairo_xcb_glyph_attach (cairo_xcb_connection_t *c, { cairo_xcb_glyph_private_t *priv; - priv = malloc (sizeof (*priv)); + priv = _cairo_malloc (sizeof (*priv)); if (unlikely (priv == NULL)) return _cairo_error (CAIRO_STATUS_NO_MEMORY); @@ -4472,7 +4472,7 @@ _cairo_xcb_surface_add_glyph (cairo_xcb_connection_t *connection, if (c == 0) break; - new = malloc (c); + new = _cairo_malloc (c); if (unlikely (new == NULL)) { status = _cairo_error (CAIRO_STATUS_NO_MEMORY); goto BAIL; @@ -4503,7 +4503,7 @@ _cairo_xcb_surface_add_glyph (cairo_xcb_connection_t *connection, if (c == 0) break; - new = malloc (4 * c); + new = _cairo_malloc (4 * c); if (unlikely (new == NULL)) { status = _cairo_error (CAIRO_STATUS_NO_MEMORY); goto BAIL; @@ -4585,7 +4585,7 @@ _emit_glyphs_chunk (cairo_xcb_surface_t *dst, int i; if (estimated_req_size > ARRAY_LENGTH (stack_buf)) { - buf = malloc (estimated_req_size); + buf = _cairo_malloc (estimated_req_size); if (unlikely (buf == NULL)) return _cairo_error (CAIRO_STATUS_NO_MEMORY); } |