<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - Null pointer dereference in cairo_image_get_surface_data()"
href="https://bugs.freedesktop.org/show_bug.cgi?id=58061">58061</a>
</td>
</tr>
<tr>
<th>Assignee</th>
<td>chris@chris-wilson.co.uk
</td>
</tr>
<tr>
<th>Summary</th>
<td>Null pointer dereference in cairo_image_get_surface_data()
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>cairo-bugs@cairographics.org
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>Windows (All)
</td>
</tr>
<tr>
<th>Reporter</th>
<td>mov_ebpesp@yahoo.com
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>1.12.8
</td>
</tr>
<tr>
<th>Component</th>
<td>general
</td>
</tr>
<tr>
<th>Product</th>
<td>cairo
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=71241" name="attach_71241" title="Detailed information of the crash.">attachment 71241</a> <a href="attachment.cgi?id=71241&action=edit" title="Detailed information of the crash.">[details]</a></span>
Detailed information of the crash.
Bug found while running gnucash 2.4.11 on windows (cross bug from gnucash
<a href="https://bugzilla.gnome.org/show_bug.cgi?id=689942">https://bugzilla.gnome.org/show_bug.cgi?id=689942</a>).
Facts
-----
Every now and then (once per 1-3 h) gnucash seems to crash. This can happen
after a save, or updating a transaction or even leaving the computer alone for
a while - when I come back it's crashed.
The crash is a null pointer exception inside
libcairo.cairo_image_get_surface_data where a comparison check is done against
0.
68DE04E1 |. 8138 20AEE968 CMP DWORD PTR DS:[EAX],libcairo.68E9AE20
libcairo.68E9AE20 is just 00 00 00 00
This bug can be fixed by first checking EAX for 0 and then checking the pointer
pointed to by EAX if it's 0.
See attached "crash.txt" for more details.
Proposed fix (credits to John Ralls from gnucash team)
------------------------------------------------------
The actual patch is:
diff --git a/src/cairo-image-surface-inline.h
b/src/cairo-image-surface-inline.h
index 743d5fd..63e0c50 100644
--- a/src/cairo-image-surface-inline.h
+++ b/src/cairo-image-surface-inline.h
@@ -74,7 +74,7 @@ static inline cairo_bool_t
_cairo_surface_is_image (const cairo_surface_t *surface)
{
/* _cairo_surface_nil sets a NULL backend so be safe */
- return surface->backend && surface->backend->type ==
CAIRO_SURFACE_TYPE_IMA
+ return surface && surface->backend && surface->backend->type ==
CAIRO_SURFA
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>