--- /dev/null
+From 5c82d91a5e15d29b1489dcb413b24ee7fdf59934 Mon Sep 17 00:00:00 2001
+From: Bryce Harrington <bryce@osg.samsung.com>
+Date: Wed, 3 Dec 2014 19:28:15 -0800
+Subject: image: Fix crash in _fill_xrgb32_lerp_opaque_spans
+
+If a span length is negative don't go out of bounds processing the fill
+data.
+
+Patch thanks to Ilya Sakhnenko <ilia.softway@gmail.com> on mailing list.
+
+Signed-off-by: Bryce Harrington <bryce@osg.samsung.com>
+
+diff --git a/src/cairo-image-compositor.c b/src/cairo-image-compositor.c
+index 6ff0f09..48072f8 100644
+--- a/src/cairo-image-compositor.c
++++ b/src/cairo-image-compositor.c
+@@ -2242,10 +2242,10 @@ _fill_xrgb32_lerp_opaque_spans (void *abstract_renderer, int y, int h,
+ spans[0].x, y, len, 1, r->u.fill.pixel);
+ } else {
+ uint32_t *d = (uint32_t*)(r->u.fill.data + r->u.fill.stride*y + spans[0].x*4);
+- while (len--)
++ while (len-- > 0)
+ *d++ = r->u.fill.pixel;
+ }
+- } else while (len--) {
++ } else while (len-- > 0) {
+ *d = lerp8x4 (r->u.fill.pixel, a, *d);
+ d++;
+ }
+--
+cgit v0.10.2
+
Summary(pl.UTF-8): Cairo - wieloplatformowa biblioteka graficzna 2D
Name: cairo
Version: 1.14.0
-Release: 3
+Release: 4
License: LGPL v2.1 or MPL v1.1
Group: Libraries
Source0: http://cairographics.org/releases/%{name}-%{version}.tar.xz
# Source0-md5: fc3a5edeba703f906f2241b394f0cced
Patch0: %{name}-link.patch
Patch1: %{name}-gobject-deps.patch
+Patch2: %{name}-fix_crash_in_fill_xrgb32_lerp_opaque_spans.patch
URL: http://cairographics.org/
%{?with_directfb:BuildRequires: DirectFB-devel}
%if %{with gl} || %{with glesv2} || %{with openvg}
%setup -q
%patch0 -p1
%patch1 -p1
+%patch2 -p1
%build
%{?with_apidocs:%{__gtkdocize}}