diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2012-06-19 21:01:47 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2012-06-19 21:01:47 +0100 |
| commit | fda9faee755cb35906ca1179a568332ef2de35a5 (patch) | |
| tree | 4e9da1adfb8fd1ce27246b260eb92952385f53bc | |
| parent | 8141e290b1ac7c4d1524bb389a84a8f375df4634 (diff) | |
uxa: Use the original src for fallback glyph compositing
In 64a4bcb8cefff, I introduced a WHITE source for the purposes of
accumulating the glyph mask correctly. Unfortunately I neglected to
restore the original source picture for compositing the glyph mask on
the destination, resulting in a use-after-free and then corruption.
Reported-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
| -rw-r--r-- | uxa/uxa-glyphs.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/uxa/uxa-glyphs.c b/uxa/uxa-glyphs.c index e83464e1..0ae0568e 100644 --- a/uxa/uxa-glyphs.c +++ b/uxa/uxa-glyphs.c @@ -451,12 +451,12 @@ uxa_check_glyphs(CARD8 op, { pixman_image_t *image; PixmapPtr scratch; - PicturePtr mask, white = NULL; + PicturePtr mask, mask_src = NULL, white = NULL; int width = 0, height = 0; int x, y, n; int xDst = list->xOff, yDst = list->yOff; BoxRec extents = { 0, 0, 0, 0 }; - CARD8 mask_op; + CARD8 mask_op = 0; if (maskFormat) { pixman_format_code_t format; @@ -504,10 +504,13 @@ uxa_check_glyphs(CARD8 op, y = -extents.y1; color.red = color.green = color.blue = color.alpha = 0xffff; - src = white = CreateSolidPicture(0, &color, &error); + white = CreateSolidPicture(0, &color, &error); mask_op = op; op = PictOpAdd; + + mask_src = src; + src = white; } else { mask = dst; x = 0; @@ -544,7 +547,7 @@ uxa_check_glyphs(CARD8 op, if (maskFormat) { x = extents.x1; y = extents.y1; - CompositePicture(mask_op, src, mask, dst, + CompositePicture(mask_op, mask_src, mask, dst, xSrc + x - xDst, ySrc + y - yDst, 0, 0, |