407677 - potential cairo int overflow in {pdf,ps}_surface

Status: RESOLVED FIXED

(Core Graveyard :: GFX, defect, P1)

Description

[georgi - hopefully not receiving bugspam]

in _cairo_{pdf,ps}_surface_emit_image there is identical code:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/gfx/cairo/cairo/src/cairo-ps-surface.c&rev=1.25&mark=2003-2004#2003
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/gfx/cairo/cairo/src/cairo-pdf-surface.c&rev=1.26&mark=1438-1439#1438
1438 rgb_size = image->height * image->width * 3;
1439 rgb = malloc (rgb_size);

_cairo_pdf_surface_emit_smask is similar:
alpha_size = image->height * image->width;
alpha = malloc (alpha_size);


height * width * 3 potentially may overflow and probably should be replaced with |malloc_abc|

even if this is dead code now it may be used some day

Comment 1

[georgi - hopefully not receiving bugspam]

this code is classical int overflow by inspection.

mainstream cairo probably should be aware of this.

marking [sg:investigate] because can't hit the code.

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Sigh, someone isn't using the safe-alloc macros that are in cairo.

Comment 3

[Brandon Sterne (:bsterne)]

We have this bug marked as a P1 blocker for Gecko 1.9.  Have we been able to make any progress here?

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

As marked in the dependency list, this will be fixed by the dependent cairo upgrade bug.

Comment 5

[Window Snyder]

There's no information in that bug.  What's the status?

Comment 6

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Just needs to be checked in; I've been waiting for the tree to quiet down because it's been closed for most of the time the last few days =/

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Update was checked in.