[cairo-bugs] [Bug 85151] Segfault when loading a PDF with a transformed image (1.14.0)

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=85151

--- Comment #3 from Massimo <sixtysix at inwind.it> ---
Created attachment 108052
  --> https://bugs.freedesktop.org/attachment.cgi?id=108052&action=edit
proposed patch

I reproduced the crash with test2.pdf and an evince built from    
git sources

$git --git-dir=evince/.git describe HEAD --long 3.14.1-0-gf1cda92
$git --git-dir=poppler/.git describe HEAD --long poppler-0.26.4-59-g745f124
$git --git-dir=cairo/.git describe HEAD --long 1.14.0-7-g51892e9

at 50% zoom.

Comparing my alternative solution to bug 84396 with that in master I recall 
that I noticed that full_row should be used only when there is no intersection 
in the current row and in the top half of the successive subrow, otherwise 
redundant (negative) spans are possibly generated when sub_row is called for
the next row and I observed a similar crash and backtrace.

The attached patch fixes the crash with test2.pdf, but I did not reproduce it
with test.pdf.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cairographics.org/archives/cairo-bugs/attachments/20141019/eb1af618/attachment.html>