<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW --- - "double free or corruption" error appeares while i try to draw dotted line" href="https://bugs.freedesktop.org/show_bug.cgi?id=75705#c1">Comment # 1</a> on <a class="bz_bug_link bz_status_NEW " title="NEW --- - "double free or corruption" error appeares while i try to draw dotted line" href="https://bugs.freedesktop.org/show_bug.cgi?id=75705">bug 75705</a> from <a class="email" href="mailto:psychon@znc.in" title="Uli Schlachter <psychon@znc.in>"> Uli Schlachter</a> <pre>Created <a href="attachment.cgi?id=95052" name="attach_95052" title="Patch adding two printfs calls highlighting the cause for the heap corruption">attachment 95052</a> <a href="attachment.cgi?id=95052&action=edit" title="Patch adding two printfs calls highlighting the cause for the heap corruption">[details]</a> <a href='page.cgi?id=splinter.html&bug=75705&attachment=95052'>[review]</a> Patch adding two printfs calls highlighting the cause for the heap corruption With the attached patch and running the test program under valgrind, we get the following output: converter->spans allocated array of size 71 Using index 71 ==15967== Invalid write of size 4 ==15967== at 0x4ED51E6: _cairo_tor22_scan_converter_generate (cairo-tor22-scan-converter.c:1443) ==15967== by 0x4EC14BF: clip_and_composite_polygon (cairo-spans-compositor.c:801) ==15967== by 0x4EC2106: _cairo_spans_compositor_stroke (cairo-spans-compositor.c:1083) ==15967== by 0x4E61EFB: _cairo_compositor_stroke.part.0 (cairo-compositor.c:157) [...] ==15967== Address 0x8333638 is 0 bytes after a block of size 568 alloc'd [...] index used So the tor22 scan converter reads one entry behind the converter's spans array. Figuring out why this happens, turning this into a unit test for the test suite and checking if the other scan converters are affected, too, is left as an excercise for someone who knows more about this code.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>