diff -u pixman-0.26.0/debian/changelog pixman-0.26.0/debian/changelog --- pixman-0.26.0/debian/changelog +++ pixman-0.26.0/debian/changelog @@ -1,3 +1,10 @@ +pixman (0.26.0-3ubuntu1) quantal; urgency=low + + * debian/patches/validate.patch: + - fix a crash when rendering invalid trapezoids. (LP: #1197921) + + -- Ritesh Khadgaray <ritesh@canonical.com> Tue, 26 Nov 2013 11:52:03 +0530 + pixman (0.26.0-3) unstable; urgency=low * Pass LS_CFLAGS=" " to configure to prevent -march=loongson2f from diff -u pixman-0.26.0/debian/patches/series pixman-0.26.0/debian/patches/series --- pixman-0.26.0/debian/patches/series +++ pixman-0.26.0/debian/patches/series @@ -1,0 +2 @@ +validate.patch --- pixman-0.26.0.orig/debian/patches/validate.patch +++ pixman-0.26.0/debian/patches/validate.patch @@ -0,0 +1,42 @@ +diff -Naurp pixman-0.26.0/pixman/pixman.h pixman-0.26.0.new/pixman/pixman.h +--- pixman-0.26.0/pixman/pixman.h 2012-05-14 23:10:58.000000000 +0530 ++++ pixman-0.26.0.new/pixman/pixman.h 2013-11-26 11:50:03.543769329 +0530 +@@ -911,7 +911,7 @@ struct pixman_triangle + #define pixman_trapezoid_valid(t) \ + ((t)->left.p1.y != (t)->left.p2.y && \ + (t)->right.p1.y != (t)->right.p2.y && \ +- (int) ((t)->bottom - (t)->top) > 0) ++ ((t)->bottom > (t)->top)) + + struct pixman_span_fix + { +diff -Naurp pixman-0.26.0/test/trap-crasher.c pixman-0.26.0.new/test/trap-crasher.c +--- pixman-0.26.0/test/trap-crasher.c 2012-05-14 23:10:58.000000000 +0530 ++++ pixman-0.26.0.new/test/trap-crasher.c 2013-11-26 11:50:03.543769329 +0530 +@@ -5,13 +5,25 @@ int + main() + { + pixman_image_t *dst; +- pixman_trapezoid_t traps[1] = { ++ pixman_trapezoid_t traps[] = { + { + 2147483646, + 2147483647, + { + { 0, 0 }, + { 0, 2147483647 } ++ }, ++ { ++ { 65536, 0 }, ++ { 0, 2147483647 } ++ } ++ }, ++ { ++ 32768, ++ - 2147483647, ++ { ++ { 0, 0 }, ++ { 0, 2147483647 } + }, + { + { 65536, 0 },