1. 20 Jul, 2020 5 commits
  2. 18 Jul, 2020 4 commits
  3. 14 Jun, 2020 1 commit
  4. 27 Feb, 2020 1 commit
  5. 14 Feb, 2020 1 commit
  6. 12 Feb, 2020 1 commit
  7. 03 Feb, 2020 1 commit
  8. 20 Dec, 2019 1 commit
  9. 14 Oct, 2019 1 commit
  10. 12 Oct, 2019 1 commit
  11. 05 Oct, 2019 1 commit
  12. 26 Jul, 2019 1 commit
  13. 18 Jul, 2019 4 commits
  14. 30 May, 2019 1 commit
    • Florian Muellner's avatar
      ft-font: Fix color font support · bab53d91
      Florian Muellner authored
      FT_PIXEL_MODE_BGRA is an enum member, not a define, so it always appears
      as 0 in the preprocessor conditions added in commit c0ed8ce1.
      
      There is an existing define for color font support, use that instead.
      bab53d91
  15. 10 May, 2019 2 commits
  16. 10 Apr, 2019 1 commit
  17. 08 Apr, 2019 2 commits
  18. 25 Mar, 2019 1 commit
  19. 14 Mar, 2019 1 commit
  20. 12 Mar, 2019 1 commit
  21. 03 Mar, 2019 1 commit
  22. 12 Feb, 2019 1 commit
    • Uli Schlachter's avatar
      steal boxes: Fix an invalif free() exposed by cb871c6c · 61cd11a3
      Uli Schlachter authored
      Commits cb871c6c made the function _cairo_clip_reduce_to_boxes()
      actually do something instead of being a no-op. This exposed a latent
      bug in cairo that was so far just not hit due to luck.
      
      The function _cairo_clip_steal_boxes() removes the boxes from a clip and
      gives them to a cairo_boxes_t. _cairo_clip_unsteal_boxes() undoes this
      operation. For efficiency reasons, cairo_clip_t contains an embedded
      cairo_box_t that is used when the clip has only one box to avoid a
      memory allocation. Thus, _cairo_clip_unsteal_boxes() must be called on
      the same clip that was given to _cairo_clip_steal_boxes(), or otherwise
      a clip could end up to the embedded box of another instance of
      cairo_clip_t. This is exactly what was happening here.
      
      For example, cairo-xcb can replace extents->clip with another clip via
      the call chain _cairo_xcb_render_compositor_paint() (which is where
      boxes are stolen) -> _clip_and_composite_boxes() ->
      trim_extents_to_traps() ->
      _cairo_composite_rectangles_intersect_mask_extents(). This function
      replaced the clip with the result of _cairo_clip_reduce_for_composite()
      and frees the old clip. At this point, the boxes that were stolen
      previously become invalid / become a dangling pointer. The crash later
      on is just one of the side effects of this.
      
      This commit fixes this problem by treating embedded boxes specially in
      _cairo_clip_steal_boxes() and _cairo_clip_unsteal_boxes(): The
      cairo_boxes_t instance also has embedded boxes. An embedded box on the
      clip is copied to these other embedded boxes. When unstealing, the
      embedded box of the clip is used again. Thus, it does not matter anymore
      that another instance of _cairo_clip_t is used for unstealing.
      
      Fixes: cairo/cairo#358Signed-off-by: Uli Schlachter's avatarUli Schlachter <psychon@znc.in>
      61cd11a3
  23. 01 Feb, 2019 6 commits