From: tscholb <scholb.kim@samsung.com>
Date: Fri, 20 May 2022 08:01:21 +0000 (+0900)
Subject: [CVE-2016-3190] Fix CVE issue
X-Git-Tag: submit/tizen/20220520.082748^0
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ffa067b0f650e8732269f8b01652b928ad8e311f;p=platform%2Fcore%2Fgraphics%2Fcairo.git

[CVE-2016-3190] Fix CVE issue

The fill_xrgb32_lerp_opaque_spans() allows remote attackers to cause a denial of service
(out-of-bounds read and application crash) via a negative span length.

Change-Id: Iebce4b5d6fd9ea6435cc88875f314fb60d81bddd
---

diff --git a/src/cairo-image-compositor.c b/src/cairo-image-compositor.c
index e343d275a..1822584d9 100644
--- a/src/cairo-image-compositor.c
+++ b/src/cairo-image-compositor.c
@@ -2370,7 +2370,7 @@ _fill_xrgb32_lerp_opaque_spans (void *abstract_renderer, int y, int h,
 			do {
 			    int len = spans[1].x - spans[0].x;
 			    uint32_t *d = (uint32_t*)(r->u.fill.data + r->u.fill.stride*yy + spans[0].x*4);
-			    while (len--)
+			    while (len-- > 0)
 				*d++ = r->u.fill.pixel;
 			    yy++;
 			} while (--hh);
@@ -2380,7 +2380,7 @@ _fill_xrgb32_lerp_opaque_spans (void *abstract_renderer, int y, int h,
 		    do {
 			int len = spans[1].x - spans[0].x;
 			uint32_t *d = (uint32_t *)(r->u.fill.data + r->u.fill.stride*yy + spans[0].x*4);
-			while (len--) {
+			while (len-- > 0) {
 			    *d = lerp8x4 (r->u.fill.pixel, a, *d);
 			    d++;
 			}