2 commits - src/cairo-recording-surface.c

[GitLab Mirror]

 src/cairo-recording-surface.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 4b775b97bf802567b03ca4f8803c81a9f3fc9d72
Merge: 425b4c834 0cd376ba0
Author: Emmanuele Bassi <ebassi at gmail.com>
Date:   Tue May 21 11:56:52 2024 +0000

    Merge branch 'moz-bug-1897561' into 'master'
    
    Fix crash if font error in recording surface
    
    See merge request cairo/cairo!551

commit 0cd376ba0b9362b79168a9c71436b2a8c9286295
Author: Adrian Johnson <ajohnson at redneon.com>
Date:   Tue May 21 18:47:18 2024 +0930

    Fix crash if font error in recording surface
    
    https://bugzilla.mozilla.org/show_bug.cgi?id=1897561

diff --git a/src/cairo-recording-surface.c b/src/cairo-recording-surface.c
index 23e98c6db..a9d812ce6 100644
--- a/src/cairo-recording-surface.c
+++ b/src/cairo-recording-surface.c
@@ -480,7 +480,7 @@ _cairo_recording_surface_region_array_destroy (cairo_recording_surface_t       *
     cairo_recording_region_element_t *region_elements;
     int i, num_elements;
 
-    num_elements = surface->commands.num_elements;
+    num_elements = MIN(surface->commands.num_elements, _cairo_array_num_elements(&region_array->regions));
     elements = _cairo_array_index (&surface->commands, 0);
     region_elements = _cairo_array_index (&region_array->regions, 0);
     for (i = 0; i < num_elements; i++) {
@@ -1154,6 +1154,10 @@ _cairo_recording_surface_show_text_glyphs (void				*abstract_surface,
 
     command->cluster_flags = cluster_flags;
 
+    status = scaled_font->status;
+    if (unlikely (status))
+	goto CLEANUP_ARRAYS;
+
     command->scaled_font = cairo_scaled_font_reference (scaled_font);
 
     status = _cairo_recording_surface_commit (surface, &command->header);