id summary reporter owner description type status priority milestone component version severity resolution keywords cc 6956 pixman-0.32.8 Fernando de Oliveira Igor Živković "[http://cairographics.org/releases/pixman-0.32.8.tar.gz] [http://cairographics.org/releases/pixman-0.32.8.tar.gz.sha1] c1119bbdb587c56009b653e6f81c083f98a20135 pixman-0.32.8.tar.gz [http://cairographics.org/releases/pixman-0.32.8.tar.gz.sha1.asc] Git: [http://cgit.freedesktop.org/pixman/] Only find empty changelog and news. perhaps the following is relevant: [http://cgit.freedesktop.org/pixman/log/?h=0.32&showmsg=1] {{{ 19 hours Post-release version bump to 0.32.90.32 Oded Gabbay 1 -1/+1 Signed-off-by: Oded Gabbay 25 hours Pre-release version bump to 0.32.8pixman-0.32.8 Oded Gabbay 1 -1/+1 Signed-off-by: Oded Gabbay 29 hours pixman-general: Fix stack related pointer arithmetic overflow Siarhei Siamashka 1 -9/+7 As https://bugs.freedesktop.org/show_bug.cgi?id=92027#c6 explains, the stack is allocated at the very top of the process address space in some configurations (32-bit x86 systems with ASLR disabled). And the careless computations done with the 'dest_buffer' pointer may overflow, failing the buffer upper limit check. The problem can be reproduced using the 'stress-test' program, which segfaults when executed via setarch: export CFLAGS=""-O2 -m32"" && ./autogen.sh ./configure --disable-libpng --disable-gtk && make setarch i686 -R test/stress-test This patch introduces the required corrections. The extra check for negative 'width' may be redundant (the invalid 'width' value is not supposed to reach here), but it's better to play safe when dealing with the buffers allocated on stack. Reported-by: Ludovic Courtès Signed-off-by: Siarhei Siamashka Reviewed-by: soren.sandmann@gmail.com Signed-off-by: Oded Gabbay 2014-07-05 Post-release version bump to 0.32.7 Søren Sandmann Pedersen 1 -1/+1 2014-07-05 Pre-release version bump to 0.32.6pixman-0.32.6 }}}" enhancement closed normal 7.9 BOOK SVN medium fixed