File cairo-CVE-2019-6461.patch of Package cairo.39352
From 09643ee1abdd5daacebfcb564448f29be9a79bac Mon Sep 17 00:00:00 2001
From: Tim Serong <tserong@suse.com>
Date: Tue, 19 Sep 2023 18:18:28 +1000
Subject: [PATCH] Avoid assert when drawing arcs with NaN angles
I hit the problem with _cairo_arc_in_direction() failing the
angle_max >= angle_min assertion earlier this year when using
Thunderbird on openSUSE Tumbleweed. Thunderbird would crash
when rendering some (but not all) HTML email due to this
assert. For some reason, one of the angles passed in was
NaN. Making _cairo_arc_in_direction() return immediately if
either angle is not finite fixed the problem for me, but I
don't know enough about the internals of Cairo to know if
this is, strictly speaking, the "right" fix. Also, having
tested again today _without_ this change applied, I am now
no longer able to reproduce the problem :-/ I still have the
same version of Cairo installed (1.17.8), but various other
packages on that system have been updated in the meantime,
so maybe that's a factor. Or maybe I'm just lucky and
haven't hit a "bad" HTML email this time...?
Fixes: https://gitlab.freedesktop.org/cairo/cairo/-/issues/352
Signed-off-by: Tim Serong <tserong@suse.com>
---
src/cairo-arc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/cairo-arc.c b/src/cairo-arc.c
index 1c891d1a0..010b9c1a7 100644
--- a/src/cairo-arc.c
+++ b/src/cairo-arc.c
@@ -188,6 +188,9 @@ _cairo_arc_in_direction (cairo_t *cr,
if (cairo_status (cr))
return;
+ if (! ISFINITE (angle_max) || ! ISFINITE (angle_min))
+ return;
+
assert (angle_max >= angle_min);
if (angle_max - angle_min > 2 * M_PI * MAX_FULL_CIRCLES) {
--
2.49.0