amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: pixman: Work around pointer arithmetic bug.

Browse source 
* gnu/packages/patches/pixman-pointer-arithmetic.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/xdisorg.scm (pixman)[source]: Use it.
This commit is contained in:
Ludovic Courtès 2015-09-21 16:01:45 +02:00
parent f88ee3ade7
commit 1def6f6b2c
3 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
gnu/packages/patches/pixman-pointer-arithmetic.patch Normal file
View file

@ -0,0 +1,15 @@
Fix <https://bugs.freedesktop.org/show_bug.cgi?id=92027> whereby
an arithemitic overflow could occur while doing pointer arithmetic,
leading pixman to use an invalid address as the destination buffer.
--- pixman-0.32.6/pixman/pixman-general.c 2015-09-21 15:14:34.695981325 +0200
+++ pixman-0.32.6/pixman/pixman-general.c 2015-09-21 15:19:48.898355548 +0200
@@ -144,8 +144,7 @@ general_composite_rect (pixman_implemen
mask_buffer = ALIGN (src_buffer + width * Bpp);
dest_buffer = ALIGN (mask_buffer + width * Bpp);
- if (ALIGN (dest_buffer + width * Bpp) >
- scanline_buffer + sizeof (stack_scanline_buffer))
+ if ((width + 1) * Bpp * 3 > sizeof (stack_scanline_buffer))
{
scanline_buffer = pixman_malloc_ab_plus_c (width, Bpp * 3, 32 * 3);