diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2010-04-30 12:37:16 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2010-04-30 12:39:59 +0100 |
| commit | b972669c9ac87d1c2ca922e12024ef5da394aa6b (patch) | |
| tree | 1b4b3049a0b290057f712ed09c04ee674d666981 /boilerplate | |
| parent | 905c345df1f828551af2ab0b751388428e4dfaf6 (diff) | |
boilerplate: Fix use after free from 3ae5723
If we want to access the surface during the cleanup, we must hold our
own reference to it. Make it so for the forced finish of the recording
surface.
Diffstat (limited to 'boilerplate')
| -rw-r--r-- | boilerplate/cairo-boilerplate.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/boilerplate/cairo-boilerplate.c b/boilerplate/cairo-boilerplate.c index 062c99e92..3b97ded4f 100644 --- a/boilerplate/cairo-boilerplate.c +++ b/boilerplate/cairo-boilerplate.c @@ -184,7 +184,14 @@ _cairo_boilerplate_recording_create_surface (const char *name, extents.y = 0; extents.width = width; extents.height = height; - return *closure = cairo_recording_surface_create (content, &extents); + return *closure = cairo_surface_reference (cairo_recording_surface_create (content, &extents)); +} + +static void +_cairo_boilerplate_recording_surface_cleanup (void *closure) +{ + cairo_surface_finish (closure); + cairo_surface_destroy (closure); } #endif @@ -351,7 +358,7 @@ static const cairo_boilerplate_target_t builtin_targets[] = { NULL, NULL, _cairo_boilerplate_get_image_surface, cairo_surface_write_to_png, - (cairo_boilerplate_cleanup_t) cairo_surface_finish, + _cairo_boilerplate_recording_surface_cleanup, NULL, FALSE, FALSE, TRUE }, @@ -363,7 +370,7 @@ static const cairo_boilerplate_target_t builtin_targets[] = { NULL, NULL, _cairo_boilerplate_get_image_surface, cairo_surface_write_to_png, - (cairo_boilerplate_cleanup_t) cairo_surface_finish, + _cairo_boilerplate_recording_surface_cleanup, NULL, FALSE, FALSE, TRUE }, |