Skip to content

cairo: Don't read from outside of coverage buffer

Marek Kasik requested to merge mkasik/poppler:736-heap-overflow-in-downsample_row_box_filter into master

The issue is that when computing coverage of the left most pixel in the box filter the rescale box filter in compute_coverage() uses single precision which causes lost of the fractional part. This results in wrong coverage values. The read outside of the coverage buffer happens because number of cycles in downsample_row_box_filter() depends on the values.

Closes #736 (closed)

Merge request reports