[cairo] crash in _fill_xrgb32_lerp_opaque_spans

[Ilya Sakhnenko]

Dear Cairo developers,

I would like to mention that the hack I used before (len-- > 0 in
_fill_xrgb32_lerp_opaque_spans) does not solve the problem. So, it might
make sense to check this problem before the next release as it really
causes memory corruption in case on multiple adjoining polygons. The dirty
hack I use now involves swapping x1 and x2 in cell_list_add_subspan and its
clipping version whenever x1 > x2.

Thank you and best regards,
Ilya
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cairographics.org/archives/cairo/attachments/20150308/b8e6da66/attachment-0001.html>