[PATCH] [cairo-xlib] Prevent creation of very large Pixmaps.

[Chris Wilson]

Prevent the user from creating very large, native similar surfaces, for
example when loading very large images, and triggering BadAlloc XErrors.

(Fixes https://bugzilla.mozilla.org/show_bug.cgi?id=424333)
---
 src/cairo-xlib-surface.c |   14 ++++++++++++--
 1 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/cairo-xlib-surface.c b/src/cairo-xlib-surface.c
index acb51c5..a957d57 100644
--- a/src/cairo-xlib-surface.c
+++ b/src/cairo-xlib-surface.c
@@ -214,6 +214,10 @@ _cairo_xlib_surface_create_similar (void	       *abstract_src,
 
     _cairo_xlib_display_notify (src->screen_info->display);
 
+    /* XXX BadAlloc await - https://bugzilla.mozilla.org/show_bug.cgi?id=424333 */
+    if (width > INT16_MAX || height > INT16_MAX)
+	return NULL;
+
     /* Start by examining the surface's XRenderFormat, or if it
      * doesn't have one, then look one up through its visual (in the
      * case of a bitmap, it won't even have that). */
@@ -1059,9 +1063,15 @@ _cairo_xlib_surface_clone_similar (void			*abstract_surface,
 	if (! CAIRO_FORMAT_VALID (image_src->format))
 	    return CAIRO_INT_STATUS_UNSUPPORTED;
 
+	/* XXX BadAlloc await - https://bugzilla.mozilla.org/show_bug.cgi?id=424333 */
+	if (image_src->width > INT16_MAX || image_src->height > INT16_MAX)
+	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+
 	clone = (cairo_xlib_surface_t *)
-	    _cairo_xlib_surface_create_similar_with_format (surface, image_src->format,
-						image_src->width, image_src->height);
+	    _cairo_xlib_surface_create_similar_with_format (surface,
+		                                            image_src->format,
+							    image_src->width,
+							    image_src->height);
 	if (clone == NULL)
 	    return CAIRO_INT_STATUS_UNSUPPORTED;
 
-- 
1.5.4.5


--=-fn1OCLrMEL6CA85ai4ve
Content-Disposition: attachment; filename=0002-cairo-xlib-Clone-a-subsurface-from-the-image-sourc.patch
Content-Type: application/mbox; name=0002-cairo-xlib-Clone-a-subsurface-from-the-image-sourc.patch
Content-Transfer-Encoding: 7bit