[cairo] crash copying recording surface to PDF surface with tags

[Uli Schlachter]

Hi Ben,

Am 26.12.20 um 10:57 schrieb Uli Schlachter:
> Anyway, I feel like this might be multiple bug reports in one, so I'd be
> happy if you could test my patches. This should fix the crashes (at
> least those that I saw so far):

and the following patch should actually fix the underlying problem.
(Sorry for the line wrapping. This just fixes the copy&paste error and
copies from the "tag" member instead of "stroke".)

diff --git a/src/cairo-recording-surface.c b/src/cairo-recording-surface.c
index 6df8b0821..c081880da 100644
--- a/src/cairo-recording-surface.c
+++ b/src/cairo-recording-surface.c
@@ -1456,17 +1456,17 @@ _cairo_recording_surface_copy__tag
(cairo_recording_surface_t *surface,
 	    command->attributes = strdup (src->tag.attributes);

 	status = _cairo_pattern_init_copy (&command->source.base,
-					   &src->stroke.source.base);
+					   &src->tag.source.base);
 	if (unlikely (status))
 	    goto err_command;

 	status = _cairo_stroke_style_init_copy (&command->style,
-						&src->stroke.style);
+						&src->tag.style);
 	if (unlikely (status))
 	    goto err_source;

-	command->ctm = src->stroke.ctm;
-	command->ctm_inverse = src->stroke.ctm_inverse;
+	command->ctm = src->tag.ctm;
+	command->ctm_inverse = src->tag.ctm_inverse;
     }

     status = _cairo_recording_surface_commit (surface, &command->header);


Kids, do not play with union. You'll lose a foot or two!

Uli
-- 
This can be a, a little complicated. Listen, my advice is... ask
somebody else for advice, at least someone who's... got more experience
at...  giving advice.