<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - NULL pointer dereference : _clip_and_composite_boxes() tries to destroy __cairo_clip_all's path"
href="https://bugs.freedesktop.org/show_bug.cgi?id=77931#c3">Comment # 3</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW --- - NULL pointer dereference : _clip_and_composite_boxes() tries to destroy __cairo_clip_all's path"
href="https://bugs.freedesktop.org/show_bug.cgi?id=77931">bug 77931</a>
from <span class="vcard"><a class="email" href="mailto:tetromino@gentoo.org" title="Alexandre Rostovtsev <tetromino@gentoo.org>"> <span class="fn">Alexandre Rostovtsev</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=77931#c2">comment #2</a>)
<span class="quote">> Instead of your patch, could you try adding the following at the beginning
> of _clip_and_composite_boxes()? Thanks (Hm, and I'd be curious how exactly
> this can happen at all, the higher levels should check for all-clipped
> earlier, I thought):
>
> if (_cairo_clip_is_all_clipped (clip))
> return CAIRO_STATUS_SUCCESS;</span >
I cannot see how that could work.
Look at the abbreviated logic of _clip_and_composite_boxes() :
if ( extents->clip->path != NULL ) {
cairo_clip_t *clip;
clip = _cairo_clip_copy (extents->clip);
clip = _cairo_clip_intersect_boxes (clip, boxes);
clip = _cairo_clip_intersect_boxes (clip, boxes); // this crashes due to
NULL dereference
}
Since we know that extents->clip->path is not NULL, we are guaranteed that the
initial value of clip is *not* the all-clipped path. In other words, the
all-clipped path is coming from result of _cairo_clip_intersect_boxes(), not
from the parameters to _clip_and_composite_boxes(). So checking for all-clipped
at the beginning of _clip_and_composite_boxes() won't help.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>