ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz#516227797 Integer-overflow

Browse Source 
the fixed-point subtractions reached from _cairo_spline_decompose_into
can overflow, so do the arithmetic in wider types

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I6c7d1fa569bfb958ac45ab10748b45acc3ba742d
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12355
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit a1af5f124e9179f74c85feab1b05e7c8f0d73ceb)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211407
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-09-24 11:01:06 +02:00
committed by Xisco Fauli
parent 1f917206a1
commit a0ffcdfe62
2 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
external/cairo/UnpackedTarball_cairo.mk
Vendored
+1
View File
@@ -30,6 +30,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,cairo,\
external/cairo/cairo/avoid-negative-left-shift.patch.1 \
external/cairo/cairo/ubsan-memcpy-nullptr.patch.1 \
external/cairo/cairo/ubsan-memcpy-nullptr2.patch.1 \
external/cairo/cairo/cairo.ofz516227797-Integer-overflow.patch.1 \
external/cairo/cairo/Wincompatible-pointer-types.patch.0 \
external/cairo/cairo/disable-cairo-utilities.patch.1 \
))
external/cairo/cairo/cairo.ofz516227797-Integer-overflow.patch.1
Vendored
+43
View File
@@ -0,0 +1,43 @@
diff -ur cairo.org/src/cairo-spline.c cairo/src/cairo-spline.c
--- cairo.org/src/cairo-spline.c 2026-09-13 14:29:04.468307688 +0000
+++ cairo/src/cairo-spline.c 2026-09-13 14:29:04.482278900 +0000
@@ -141,8 +141,10 @@
static void
_lerp_half (const cairo_point_t *a, const cairo_point_t *b, cairo_point_t *result)
{
- result->x = a->x + ((b->x - a->x) >> 1);
- result->y = a->y + ((b->y - a->y) >> 1);
+ /* The midpoint lies between the two points, so the result fits in a
+ * cairo_fixed_t even when the distance between them does not. */
+ result->x = (cairo_fixed_t) ((int64_t) a->x + (((int64_t) b->x - a->x) >> 1));
+ result->y = (cairo_fixed_t) ((int64_t) a->y + (((int64_t) b->y - a->y) >> 1));
}
static void
@@ -181,11 +183,11 @@
* and c control points and the segment a-b. The maximum of these two
* distances will be our approximation error. */
- bdx = _cairo_fixed_to_double (knots->b.x - knots->a.x);
- bdy = _cairo_fixed_to_double (knots->b.y - knots->a.y);
+ bdx = _cairo_fixed_to_double (knots->b.x) - _cairo_fixed_to_double (knots->a.x);
+ bdy = _cairo_fixed_to_double (knots->b.y) - _cairo_fixed_to_double (knots->a.y);
- cdx = _cairo_fixed_to_double (knots->c.x - knots->a.x);
- cdy = _cairo_fixed_to_double (knots->c.y - knots->a.y);
+ cdx = _cairo_fixed_to_double (knots->c.x) - _cairo_fixed_to_double (knots->a.x);
+ cdy = _cairo_fixed_to_double (knots->c.y) - _cairo_fixed_to_double (knots->a.y);
if (knots->a.x != knots->d.x || knots->a.y != knots->d.y) {
/* Intersection point (px):
@@ -197,8 +199,8 @@
double dx, dy, u, v;
- dx = _cairo_fixed_to_double (knots->d.x - knots->a.x);
- dy = _cairo_fixed_to_double (knots->d.y - knots->a.y);
+ dx = _cairo_fixed_to_double (knots->d.x) - _cairo_fixed_to_double (knots->a.x);
+ dy = _cairo_fixed_to_double (knots->d.y) - _cairo_fixed_to_double (knots->a.y);
v = dx * dx + dy * dy;
u = bdx * dx + bdy * dy;