[cairo-commit] 2 commits - src/cairo-recording-surface.c

[GitLab Mirror]

 src/cairo-recording-surface.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit beb28b76793ac84b0936e9104da058c502797970
Merge: 70e37e23d 2cd425665
Author: Adrian Johnson <ajohnson at redneon.com>
Date:   Wed Mar 1 21:22:28 2023 +0000

    Merge branch 'dont-free-nonheap-object' into 'master'
    
    Open-code bbtree_del to avoid free()ing a non-allocated object
    
    Closes #645
    
    See merge request cairo/cairo!465

commit 2cd42566524d3fdce4fc112ad7d72c95e4b860dd
Author: Matt Turner <mattst88 at gmail.com>
Date:   Wed Mar 1 13:07:49 2023 -0500

    Open-code bbtree_del to avoid free()ing a non-allocated object
    
    As we do already in _cairo_recording_surface_finish. Otherwise, the
    cleanup path of _cairo_recording_surface_create_bbtree() could call
    free() on surface->bbtree which is not dynamically allocated.
    
    Closes: https://gitlab.freedesktop.org/cairo/cairo/-/issues/645

diff --git a/src/cairo-recording-surface.c b/src/cairo-recording-surface.c
index 158ea16ba..2912f5ede 100644
--- a/src/cairo-recording-surface.c
+++ b/src/cairo-recording-surface.c
@@ -364,7 +364,10 @@ _cairo_recording_surface_create_bbtree (cairo_recording_surface_t *surface)
     return CAIRO_STATUS_SUCCESS;
 
 cleanup:
-    bbtree_del (&surface->bbtree);
+    if (surface->bbtree.left)
+	bbtree_del (surface->bbtree.left);
+    if (surface->bbtree.right)
+	bbtree_del (surface->bbtree.right);
     return status;
 }