Fix read of BITS members from a solid image.

During the fast-path query, the read_func and write_func from the bits
structure are queried for the solid image.

==32723== Conditional jump or move depends on uninitialised value(s)
==32723==    at 0x412AF20: _pixman_run_fast_path (pixman-utils.c:681)
==32723==    by 0x4136319: sse2_composite (pixman-sse2.c:5554)
==32723==    by 0x4100CD2: _pixman_implementation_composite
(pixman-implementation.c:227)
==32723==    by 0x412396E: pixman_image_composite (pixman.c:140)
==32723==    by 0x4123D64: pixman_image_fill_rectangles (pixman.c:322)
==32723==    by 0x40482B7: _cairo_image_surface_fill_rectangles
(cairo-image-surface.c:1180)
==32723==    by 0x4063BE7: _cairo_surface_fill_rectangles
(cairo-surface.c:1883)
==32723==    by 0x4063E38: _cairo_surface_fill_region
(cairo-surface.c:1840)
==32723==    by 0x4067FDC: _clip_and_composite_trapezoids
(cairo-surface-fallback.c:625)
==32723==    by 0x40689C5: _cairo_surface_fallback_paint
(cairo-surface-fallback.c:835)
==32723==    by 0x4065731: _cairo_surface_paint (cairo-surface.c:1923)
==32723==    by 0x4044098: _cairo_gstate_paint (cairo-gstate.c:900)
==32723==  Uninitialised value was created by a heap allocation
==32723==    at 0x402732D: malloc (vg_replace_malloc.c:180)
==32723==    by 0x410099F: _pixman_image_allocate (pixman-image.c:100)
==32723==    by 0x41265B8: pixman_image_create_solid_fill
(pixman-solid-fill.c:75)
==32723==    by 0x4123CE1: pixman_image_fill_rectangles (pixman.c:314)
==32723==    by 0x40482B7: _cairo_image_surface_fill_rectangles
(cairo-image-surface.c:1180)
==32723==    by 0x4063BE7: _cairo_surface_fill_rectangles
(cairo-surface.c:1883)
==32723==    by 0x4063E38: _cairo_surface_fill_region
(cairo-surface.c:1840)
==32723==    by 0x4067FDC: _clip_and_composite_trapezoids
(cairo-surface-fallback.c:625)
==32723==    by 0x40689C5: _cairo_surface_fallback_paint
(cairo-surface-fallback.c:835)
==32723==    by 0x4065731: _cairo_surface_paint (cairo-surface.c:1923)
==32723==    by 0x4044098: _cairo_gstate_paint (cairo-gstate.c:900)
==32723==    by 0x403C10B: cairo_paint (cairo.c:2052)

diff --git a/pixman/pixman-utils.c b/pixman/pixman-utils.c
index 2c34d02..a981418 100644 (file)
--- a/pixman/pixman-utils.c
+++ b/pixman/pixman-utils.c
@@ -646,23 +646,40 @@ _pixman_run_fast_path (const pixman_fast_path_t *paths,
     pixman_bool_t mask_repeat =
        mask && mask->common.repeat == PIXMAN_REPEAT_NORMAL;
     pixman_bool_t result;
+    pixman_bool_t has_fast_path;
 
-    if ((src->type == BITS || _pixman_image_is_solid (src)) &&
-        (!mask || mask->type == BITS)
-        && !src->common.transform && !(mask && mask->common.transform)
-       && !src->common.alpha_map && !dest->common.alpha_map
-        && !(mask && mask->common.alpha_map)
-        && (src->common.filter != PIXMAN_FILTER_CONVOLUTION)
-        && (src->common.repeat != PIXMAN_REPEAT_PAD)
-        && (src->common.repeat != PIXMAN_REPEAT_REFLECT)
-        && (!mask || (mask->common.filter != PIXMAN_FILTER_CONVOLUTION &&
-                      mask->common.repeat != PIXMAN_REPEAT_PAD &&
-                      mask->common.repeat != PIXMAN_REPEAT_REFLECT))
-        && !src->bits.read_func && !src->bits.write_func
-        && !(mask && mask->bits.read_func)
-        && !(mask && mask->bits.write_func)
-        && !dest->bits.read_func
-        && !dest->bits.write_func)
+    has_fast_path = !dest->common.alpha_map &&
+                   !dest->bits.read_func &&
+                   !dest->bits.write_func;
+
+    if (has_fast_path)
+    {
+       has_fast_path = (src->type == BITS || _pixman_image_is_solid (src)) &&
+                       !src->common.transform &&
+                       !src->common.alpha_map &&
+                       src->common.filter != PIXMAN_FILTER_CONVOLUTION &&
+                       src->common.repeat != PIXMAN_REPEAT_PAD &&
+                       src->common.repeat != PIXMAN_REPEAT_REFLECT;
+       if (has_fast_path && src->type == BITS)
+       {
+           has_fast_path = !src->bits.read_func &&
+                           !src->bits.write_func;
+       }
+    }
+
+    if (mask && has_fast_path)
+    {
+       has_fast_path = mask->type == BITS &&
+                       !mask->common.transform &&
+                       !mask->common.alpha_map &&
+                       !mask->bits.read_func &&
+                       !mask->bits.write_func &&
+                       mask->common.filter != PIXMAN_FILTER_CONVOLUTION &&
+                       mask->common.repeat != PIXMAN_REPEAT_PAD &&
+                       mask->common.repeat != PIXMAN_REPEAT_REFLECT;
+    }
+
+    if (has_fast_path)
     {
        const pixman_fast_path_t *info;
        pixman_bool_t pixbuf;