diff options
| author | Matthias Clasen <mclasen@redhat.com> | 2022-03-16 15:46:51 -0400 |
|---|---|---|
| committer | Matthias Clasen <mclasen@redhat.com> | 2022-03-18 23:46:16 -0400 |
| commit | 5de30b596bd4b2b65715fc283264448127ca4b61 (patch) | |
| tree | 91a729f073a340c2563dcb1053fa48b110e87617 /pango/pango-attributes.c | |
| parent | 74e437bc6502aae80b3a3a9b0775cbd841665617 (diff) | |
| download | pango-5de30b596bd4b2b65715fc283264448127ca4b61.tar.gz | |
AVoid a use-after-free in pango_attr_list_change
This was showing up as crashes in pitivi and inkscape.
The added test does not crash, but it does produce
the wrong result without the fix.
Fixes: #678
Diffstat (limited to 'pango/pango-attributes.c')
| -rw-r--r-- | pango/pango-attributes.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/pango/pango-attributes.c b/pango/pango-attributes.c index 4d7111fa..20809afc 100644 --- a/pango/pango-attributes.c +++ b/pango/pango-attributes.c @@ -2157,6 +2157,9 @@ pango_attr_list_change (PangoAttrList *list, if (tmp_attr->klass->type != attr->klass->type) continue; + if (tmp_attr == attr) + continue; + if (tmp_attr->end_index <= attr->end_index || pango_attribute_equal (tmp_attr, attr)) { |