<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - DoS attack based on using SVG to generate invalid pointers from a _cairo_image_surface in write_png"
href="https://bugs.freedesktop.org/show_bug.cgi?id=98165#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - DoS attack based on using SVG to generate invalid pointers from a _cairo_image_surface in write_png"
href="https://bugs.freedesktop.org/show_bug.cgi?id=98165">bug 98165</a>
from <span class="vcard"><a class="email" href="mailto:jbowler@acm.org" title="John Bowler <jbowler@acm.org>"> <span class="fn">John Bowler</span></a>
</span></b>
<pre>If cairo does support bottom-up surfaces, as are typically used in engineering
analysis (where 'z' comes out of the page) then that is the correct solution.
Indeed, the change made to write_png (the cast to (size_t)) does not work
because the surface is not made inside cairo-png.c (as in read_png).
Internally libpng uses ptrdiff_t because the libpng "simplified API" accepts an
image buffer with a negative stride; stride is 31-bit signed in the API but the
local variables initialized using it are ptrdiff_t.
With hindsight it would have been better to use ptrdiff_t in the API, but the
CVEs only started rolling in after the API had been in use for a while.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>