cairo: fix raster_fuzzer — remove PDF API calls that prevent acquire callback#15086
Open
OwenSanzas wants to merge 1 commit intogoogle:masterfrom
Open
cairo: fix raster_fuzzer — remove PDF API calls that prevent acquire callback#15086OwenSanzas wants to merge 1 commit intogoogle:masterfrom
OwenSanzas wants to merge 1 commit intogoogle:masterfrom
Conversation
…callback from firing cairo_pdf_surface_set_page_label() and cairo_pdf_surface_set_metadata() are PDF-surface-specific APIs. When called on the image surface created by cairo_image_surface_create_from_png(), _extract_pdf_surface() sets the surface status to CAIRO_STATUS_SURFACE_TYPE_MISMATCH. This contaminated error state causes cairo_paint() to short-circuit, so the raster source acquire callback is never invoked — the fuzzer's entire testing target (raster source pattern) is dead code. Removing these two calls and the unnecessary #include <cairo-pdf.h> allows cairo_paint() to proceed normally, triggering the acquire/release callbacks as intended.
|
OwenSanzas is a new contributor to projects/cairo. The PR must be approved by known contributors before it can be merged. The past contributors are: hunsche, Teemperor, tysmith, DonggeLiu, salmonx, Google-Autofuzz, inferno-chromium, ecalp-tps |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
raster_fuzzerharness is intended to test cairo's raster source pattern mechanism (theacquire/releasecallbacks). However, two misplaced calls to PDF-surface-specific APIs on an image surface contaminate the surface's error state, causingcairo_paint()to short-circuit. As a result, theacquirecallback is never triggered, and the harness's core testing target is completely dead code.Root Cause
In
raster_fuzzer.c, lines 61–62:Here,
surfaceis an image surface created bycairo_image_surface_create_from_png(). These two functions are designed exclusively for PDF surfaces. Internally, they call_extract_pdf_surface(), which checks whether the surface is paginated. When it is not, it sets the surface's error status toCAIRO_STATUS_SURFACE_TYPE_MISMATCH:Once the surface enters this error state,
cairo_paint()checks the target surface status and short-circuits without performing any drawing — so the raster sourceacquirecallback is never invoked.Verification
I wrote a standalone test program that isolates the issue:
Without PDF calls:
With PDF calls on image surface:
The acquire callback fires normally without the PDF calls, but is never triggered when the PDF calls are present.
Coverage Comparison (600s each)
Fix
Remove the two PDF-specific calls and the unnecessary
#include <cairo-pdf.h>. This allowscairo_paint()to proceed normally, triggering the acquire/release callbacks as intended.