642721 - _cairo_d2d_mask reads uninitialized memory

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

When 'clip' is NULL, we reach

       box.p1.x = MAX(box.p1.x, boxes->p1.x);
       box.p2.x = MIN(box.p2.x, boxes->p2.x);
       box.p1.y = MAX(box.p1.y, boxes->p1.y);
       box.p2.y = MIN(box.p2.y, boxes->p2.y);

with 'boxes' set to &box_stack, which is uninitialized on the stack. We seem to be getting lucky most of the time and these operations are having no effect, but with some patches in my queue, we stop getting lucky and reftests start failing :-(.

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

correction, test_canvas.html starts failing.

Comment 3

[Bas Schouten (:bas.schouten)]

This is certainly an improvement!

We're not getting lucky most of the time however, and I could r+ this, however the code you're fixing is from the unreviewed patch from bug 600760 :). In other words it's not being tested (it's not even present) at the moment and that's probably the only reason the test doesn't fail without your patch queue, since that patch is in your patch queue.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Aha! Well then, feel free to roll this into bug 600760.

Comment 5

[Bas Schouten (:bas.schouten)]

(In reply to comment #4)
> Aha! Well then, feel free to roll this into bug 600760.

Will do! Thanks for catching this. I hope it didn't cause too much trouble.

Comment 6

[Bas Schouten (:bas.schouten)]

Comment on attachment 520126 [details] [diff] [review]
fix

This was fixed in the original patch this bug was in.