[cairo-commit] 2 commits - src/cairo-tag-stack.c

[GitLab Mirror]

 src/cairo-tag-stack.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

New commits:
commit 42555cb0a7561909d7bc6a45a5c39340e45d0c59
Merge: d68eb3c8d 4e0f76473
Author: Uli Schlachter <psychon at znc.in>
Date:   Thu Jun 29 15:11:17 2023 +0000

    Merge branch 'tag_stack' into 'master'
    
    Fix use-after-free in _cairo_tag_stack_pop
    
    See merge request cairo/cairo!483

commit 4e0f76473fcb724b4ef8089e428fcd8e6261f159
Author: Jonathan Kew <jfkthame at googlemail.com>
Date:   Thu Jun 29 12:52:33 2023 +0000

    Fix use-after-free in _cairo_tag_stack_pop

diff --git a/src/cairo-tag-stack.c b/src/cairo-tag-stack.c
index 7341aa41a..095cd73f8 100644
--- a/src/cairo-tag-stack.c
+++ b/src/cairo-tag-stack.c
@@ -233,10 +233,12 @@ _cairo_tag_stack_pop (cairo_tag_stack_t *stack,
     cairo_list_del (&top->link);
     stack->size--;
     if (strcmp (top->name, name) != 0) {
+	cairo_status_t status =
+	    _cairo_tag_error ("cairo_tag_end(\"%s\") does not matching previous begin tag \"%s\"",
+			      name, top->name);
 	stack->type = TAG_TYPE_INVALID;
 	_cairo_tag_stack_free_elem (top);
-	return _cairo_tag_error ("cairo_tag_end(\"%s\") does not matching previous begin tag \"%s\"",
-				 name, top->name);
+	return status;
     }
 
     if (elem)