[Pixman] [PATCH 2/3] pixman_composite_trapezoids: Return early if mask_format is not of TYPE_ALPHA

Søren Sandmann sandmann at cs.au.dk
Thu Dec 13 13:14:03 PST 2012

From: Søren Sandmann Pedersen <ssp at redhat.com>

stress-test -s 0x17ee crashes because pixman_composite_trapezoids() is
given a mask_format of PIXMAN_c8, which causes it to create a
temporary image with that format but without a palette. This causes
crashes later.

The only mask_format that we actually support are those of TYPE_ALPHA,
so this patch add a return_if_fail() to ensure this.

Similarly, although currently it won't crash if given an invalid
format, alpha-only formats have always been the only thing that made
sense for the pixman_rasterize_edges() functions, so add a
return_if_fail() ensuring that the destination format is of type
 pixman/pixman-edge.c | 1 +
 pixman/pixman-trap.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/pixman/pixman-edge.c b/pixman/pixman-edge.c
index 8d498ab..ad6dfc4 100644
--- a/pixman/pixman-edge.c
+++ b/pixman/pixman-edge.c
@@ -374,6 +374,7 @@ pixman_rasterize_edges (pixman_image_t *image,
                         pixman_fixed_t  b)
     return_if_fail (image->type == BITS);
+    return_if_fail (PIXMAN_FORMAT_TYPE (image->bits.format) == PIXMAN_TYPE_A);
     if (image->bits.read_func || image->bits.write_func)
 	pixman_rasterize_edges_accessors (image, l, r, t, b);
diff --git a/pixman/pixman-trap.c b/pixman/pixman-trap.c
index ab5c8c8..4dad179 100644
--- a/pixman/pixman-trap.c
+++ b/pixman/pixman-trap.c
@@ -491,6 +491,8 @@ pixman_composite_trapezoids (pixman_op_t		op,
     int i;
+    return_if_fail (PIXMAN_FORMAT_TYPE (mask_format) == PIXMAN_TYPE_A);
     if (n_traps <= 0)

More information about the Pixman mailing list