pixman: Changes to 'debian-unstable'
debian/changelog | 7 +++++++
pixman/pixman.h | 2 +-
test/trap-crasher.c | 14 +++++++++++++-
3 files changed, 21 insertions(+), 2 deletions(-)
New commits:
commit 166899c9130b619fb2d62e23adbed4f52d5320e2
Author: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Date: Mon Nov 18 15:55:02 2013 +0100
release to sid
diff --git a/debian/changelog b/debian/changelog
index 1694686..e9e6f0f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-pixman (0.30.2-2) UNRELEASED; urgency=low
+pixman (0.30.2-2) sid; urgency=low
* Cherry-pick upstream bigfixes for fixing a crash when rendering
invalid trapezoids. (LP: #1197921)
commit 7d8317abd4af300227c3247dd0517a3da6ab8ccc
Author: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Date: Mon Nov 18 15:54:49 2013 +0100
Cherry-pick upstream bigfixes for fixing a crash when rendering invalid trapezoids. (LP: #1197921)
diff --git a/debian/changelog b/debian/changelog
index 6d40687..1694686 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+pixman (0.30.2-2) UNRELEASED; urgency=low
+
+ * Cherry-pick upstream bigfixes for fixing a crash when rendering
+ invalid trapezoids. (LP: #1197921)
+
+ -- Maarten Lankhorst <maarten.lankhorst@ubuntu.com> Mon, 18 Nov 2013 15:08:56 +0100
+
pixman (0.30.2-1) sid; urgency=low
* New upstream release
commit f740a26fe134da71d0f53df42796c5a131ef1cd4
Author: Ritesh Khadgaray <khadgaray@gmail.com>
Date: Wed Oct 23 17:29:07 2013 -0400
pixman_trapezoid_valid(): Fix underflow when bottom is close to MIN_INT
If t->bottom is close to MIN_INT (probably invalid value), subtracting
top can lead to underflow which causes crashes. Attached patch will
fix the issue.
This fixes bug 67484.
(cherry picked from commit 5e14da97f16e421d084a9e735be21b1025150f0c)
diff --git a/pixman/pixman.h b/pixman/pixman.h
index 7ff9fb5..509ba5e 100644
--- a/pixman/pixman.h
+++ b/pixman/pixman.h
@@ -1030,7 +1030,7 @@ struct pixman_triangle
#define pixman_trapezoid_valid(t) \
((t)->left.p1.y != (t)->left.p2.y && \
(t)->right.p1.y != (t)->right.p2.y && \
- (int) ((t)->bottom - (t)->top) > 0)
+ ((t)->bottom > (t)->top))
struct pixman_span_fix
{
commit f4acde9c71de7be9a2950b9a653b0ba8bea44cf3
Author: Søren Sandmann Pedersen <ssp@redhat.com>
Date: Wed Oct 23 17:28:11 2013 -0400
test/trap-crasher.c: Add trapezoid that demonstrates a crash
This trapezoid causes a crash due to an underflow in the
pixman_trapezoid_valid().
Test case from Ritesh Khadgaray.
(cherry picked from commit 2f876cf86718d3dd9b3b04ae9552530edafe58a1)
diff --git a/test/trap-crasher.c b/test/trap-crasher.c
index 4e4cac2..77be1c9 100644
--- a/test/trap-crasher.c
+++ b/test/trap-crasher.c
@@ -5,7 +5,7 @@ int
main()
{
pixman_image_t *dst;
- pixman_trapezoid_t traps[1] = {
+ pixman_trapezoid_t traps[] = {
{
2147483646,
2147483647,
@@ -18,6 +18,18 @@ main()
{ 0, 2147483647 }
}
},
+ {
+ 32768,
+ - 2147483647,
+ {
+ { 0, 0 },
+ { 0, 2147483647 }
+ },
+ {
+ { 65536, 0 },
+ { 0, 2147483647 }
+ }
+ },
};
dst = pixman_image_create_bits (PIXMAN_a8, 1, 1, NULL, -1);
Reply to: