Fix another NULL dereference in pixman-compose.c, reported by Joel

Bosveld.

Update TODO.

diff --git a/TODO b/TODO
index fc457af..2c3c150 100644 (file)
--- a/TODO
+++ b/TODO
@@ -1,12 +1,14 @@
+  - Make pixman_region_point_in() survive a NULL box, then fix up
+    pixman-compose.c
+
+  - Test suite
+
   - Add a general way of dealing with architecture specific
     fast-paths.  The current idea is to have each operation that can
     be optimized is called through a function pointer that is
     initially set to an initialization function that is responsible for
     setting the function pointer to the appropriate fast-path.
 
-  - Get rid of the switch-of-doom; replace it with a big table
-    describing the various fast paths.
-
   - Go through things marked FIXME
 
   - Add calls to prepare and finish access where necessary.  grep for
@@ -94,6 +96,9 @@
 
 done:
 
+- Get rid of the switch-of-doom; replace it with a big table
+  describing the various fast paths.
+
 - Make source clipping optional.
     - done: source clipping happens through an indirection.
         still needs to make the indirection settable. (And call it

diff --git a/pixman/pixman-compose.c b/pixman/pixman-compose.c
index f56885f..94fef6c 100644 (file)
--- a/pixman/pixman-compose.c
+++ b/pixman/pixman-compose.c
@@ -4082,7 +4082,7 @@ fbFetchTransformed_Bilinear_General(bits_image_t * pict, int width, uint32_t *bu
 static void
 fbFetchTransformed_Convolution(bits_image_t * pict, int width, uint32_t *buffer, uint32_t *mask, uint32_t maskBits, pixman_bool_t affine, pixman_vector_t v, pixman_vector_t unit)
 {
-    pixman_box16_t *box = NULL;
+    pixman_box16_t dummy;
     fetchPixelProc fetch;
     int i;
 
@@ -4144,7 +4144,7 @@ fbFetchTransformed_Convolution(bits_image_t * pict, int width, uint32_t *buffer,
                                 default:
                                     tx = x;
                             }
-                            if (pixman_region_contains_point (pict->common.src_clip, tx, ty, box)) {
+                            if (pixman_region_contains_point (pict->common.src_clip, tx, ty, &dummy)) {
                                 uint32_t c = fetch(pict, tx, ty);
 
                                 srtot += Red(c) * *p;