<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - segmentation fault during poppler_page_render (crashes inside _fill_xrgb32_lerp_opaque_spans)" href="https://bugs.freedesktop.org/show_bug.cgi?id=89521#c6">Comment # 6</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - segmentation fault during poppler_page_render (crashes inside _fill_xrgb32_lerp_opaque_spans)" href="https://bugs.freedesktop.org/show_bug.cgi?id=89521">bug 89521</a> from <a class="email" href="mailto:bryce@osg.samsung.com" title="Bryce Harrington <bryce@osg.samsung.com>"> Bryce Harrington</a> <pre>The backtrace you posted unfortunately is against a cairo built without symbols, so it's not clear where the crash within Cairo happened. What Ilia might be referring to is that the fix is suitably defensive but doesn't address why the value is negative in the first place. So, the patch probably did actually fix the crashing behavior, but there may also need to be some input value checking added somewhere. I've opted to squash the two patches and land them, as they're also adding defensive programming checks. I'll leave the bug open for now, if others wish to investigate why the invalid inputs are entering Cairo. commit 63f14d4a8f155ebaaca63b49e7bacca55d681af5 Author: Doran Moppert <<a href="mailto:dmoppert@redhat.com">dmoppert@redhat.com</a>> AuthorDate: Mon Jul 25 11:00:21 2016 +0930 Commit: Bryce Harrington <<a href="mailto:bryce@osg.samsung.com">bryce@osg.samsung.com</a>> CommitDate: Mon Aug 21 17:08:47 2017 -0700 image: Check for negative len in fill/blit functions Applies the same fix as 5c82d91 to other potential negative len cases. Reviewed-by: Bryce Harrington <<a href="mailto:bryce@osg.samsung.com">bryce@osg.samsung.com</a>></pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>