Bugzilla

### Security Approval Request
* **How easily could an exploit be constructed based on the patch?**: I'd call it "moderate" in terms of easiness. (Though an exploit would require completing a print job -- this code is only used when we actually proceed with a print operation, and I think in particular a print to the Save to PDF backend).
* **Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?**: No
* **Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?**: all supported branches (beta, release, ESR115) are affected
* **If not all supported branches, which bug introduced the flaw?**: None
* **Do you have backports for the affected branches?**: No
* **If not, how different, hard to create, and risky will they be?**: I'm pretty sure the patch applies cleanly to all affected branches; this is a snapshot of upstream cairo code, which changes very rarely (and this piece in particular seems to not have changed in a while).
* **How likely is this patch to cause regressions; how much testing does it need?**: Unlikely to cause regressions; just initializing some fields that were otherwise left uninitialized.
* **Is the patch ready to land after security approval is given?**: Yes
* **Is Android affected?**: Yes

### Security Approval Request
* **How easily could an exploit be constructed based on the patch?**: I'd call it "moderate" in terms of easiness. (Though an exploit would require completing a print job -- this code is only used when we actually proceed with a print operation ~and I think in particular a print to the Save to PDF backend~ [UPDATE: This crash affects printing to "real" printers, too]
* **Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?**: No
* **Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?**: all supported branches (beta, release, ESR115) are affected
* **If not all supported branches, which bug introduced the flaw?**: None
* **Do you have backports for the affected branches?**: No
* **If not, how different, hard to create, and risky will they be?**: I'm pretty sure the patch applies cleanly to all affected branches; this is a snapshot of upstream cairo code, which changes very rarely (and this piece in particular seems to not have changed in a while).
* **How likely is this patch to cause regressions; how much testing does it need?**: Unlikely to cause regressions; just initializing some fields that were otherwise left uninitialized.
* **Is the patch ready to land after security approval is given?**: Yes
* **Is Android affected?**: Yes

### Security Approval Request
* **How easily could an exploit be constructed based on the patch?**: I'd call it "moderate" in terms of easiness. (Though an exploit would require completing a print job -- this code is only used when we actually proceed with a print operation ~and I think in particular a print to the Save to PDF backend~ [UPDATE: This crash affects printing to "real" printers, too, I guess because we use cairo to generate the rendering that we send to the printer]
* **Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?**: No
* **Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?**: all supported branches (beta, release, ESR115) are affected
* **If not all supported branches, which bug introduced the flaw?**: None
* **Do you have backports for the affected branches?**: No
* **If not, how different, hard to create, and risky will they be?**: I'm pretty sure the patch applies cleanly to all affected branches; this is a snapshot of upstream cairo code, which changes very rarely (and this piece in particular seems to not have changed in a while).
* **How likely is this patch to cause regressions; how much testing does it need?**: Unlikely to cause regressions; just initializing some fields that were otherwise left uninitialized.
* **Is the patch ready to land after security approval is given?**: Yes
* **Is Android affected?**: Yes