Skip to content

texture-cache: Fix invalid reads when storing used resource scales

Sebastian Keller requested to merge skeller/gnome-shell:st-texture-cache-invalid-read into master

The used_scales hash table uses g_double_hash and g_double_equal which try to read a double from the passed pointers. The pointers however were pointing to a float, leading to an invalid read.

==24322== Conditional jump or move depends on uninitialised value(s)
==24322==    at 0x4D0BDF6: g_hash_table_lookup_node (ghash.c:487)
==24322==    by 0x4D0BDF6: g_hash_table_insert_internal (ghash.c:1589)
==24322==    by 0x5BE44C2: st_texture_cache_load_file_sync_to_cairo_surface (st-texture-cache.c:1497)
==24322==    by 0x5BE44C2: st_texture_cache_load_file_to_cairo_surface (st-texture-cache.c:1569)
==24322==    by 0x5BEEBAF: create_cairo_pattern_of_background_image (st-theme-node-drawing.c:653)
==24322==    by 0x5BEEBAF: st_theme_node_prerender_background (st-theme-node-drawing.c:1116)
==24322==    by 0x5BF190F: st_theme_node_render_resources (st-theme-node-drawing.c:1569)
==24322==    by 0x5BF190F: st_theme_node_paint (st-theme-node-drawing.c:2598)
==24322==    by 0x5BF7D5F: st_widget_paint_background (st-widget.c:433)
==24322==    by 0x5BF7D98: st_widget_paint (st-widget.c:445)
==24322==    by 0x56B41FF: clutter_actor_continue_paint (clutter-actor.c:4174)
==24322==    by 0x5707F2E: clutter_paint_node_paint (clutter-paint-node.c:1014)
==24322==    by 0x5707F4A: clutter_paint_node_paint (clutter-paint-node.c:1021)
==24322==    by 0x56BB62E: clutter_actor_paint (clutter-actor.c:4110)
==24322==    by 0x5BF4F6A: st_viewport_paint (st-viewport.c:402)
==24322==    by 0x56B41FF: clutter_actor_continue_paint (clutter-actor.c:4174)
==24322== 
==24322== Conditional jump or move depends on uninitialised value(s)
==24322==    at 0x4D0BDF6: g_hash_table_lookup_node (ghash.c:487)
==24322==    by 0x4D0BDF6: g_hash_table_insert_internal (ghash.c:1589)
==24322==    by 0x5BE42BF: st_texture_cache_load_file_sync_to_cogl_texture (st-texture-cache.c:1447)
==24322==    by 0x5BE42BF: st_texture_cache_load_file_to_cogl_texture (st-texture-cache.c:1532)
==24322==    by 0x5BF2ED9: st_theme_node_load_background_image (st-theme-node-drawing.c:1425)
==24322==    by 0x5BF2ED9: st_theme_node_paint (st-theme-node-drawing.c:2677)
==24322==    by 0x5BF7D5F: st_widget_paint_background (st-widget.c:433)
==24322==    by 0x5BF7D98: st_widget_paint (st-widget.c:445)
==24322==    by 0x56B41FF: clutter_actor_continue_paint (clutter-actor.c:4174)
==24322==    by 0x5707F2E: clutter_paint_node_paint (clutter-paint-node.c:1014)
==24322==    by 0x5707F4A: clutter_paint_node_paint (clutter-paint-node.c:1021)
==24322==    by 0x56BB62E: clutter_actor_paint (clutter-actor.c:4110)
==24322==    by 0x56BBEE5: clutter_actor_real_paint (clutter-actor.c:3819)
==24322==    by 0x56B41FF: clutter_actor_continue_paint (clutter-actor.c:4174)
==24322==    by 0x5707F2E: clutter_paint_node_paint (clutter-paint-node.c:1014)
==24322== 
==24322== Invalid read of size 8
==24322==    at 0x4D0D450: g_double_equal (ghash.c:2474)
==24322==    by 0x4D0BDF3: g_hash_table_lookup_node (ghash.c:487)
==24322==    by 0x4D0BDF3: g_hash_table_insert_internal (ghash.c:1589)
==24322==    by 0x5BE42BF: st_texture_cache_load_file_sync_to_cogl_texture (st-texture-cache.c:1447)
==24322==    by 0x5BE42BF: st_texture_cache_load_file_to_cogl_texture (st-texture-cache.c:1532)
==24322==    by 0x5BF2ED9: st_theme_node_load_background_image (st-theme-node-drawing.c:1425)
==24322==    by 0x5BF2ED9: st_theme_node_paint (st-theme-node-drawing.c:2677)
==24322==    by 0x5BF7D5F: st_widget_paint_background (st-widget.c:433)
==24322==    by 0x5BF7D98: st_widget_paint (st-widget.c:445)
==24322==    by 0x56B41FF: clutter_actor_continue_paint (clutter-actor.c:4174)
==24322==    by 0x5707F2E: clutter_paint_node_paint (clutter-paint-node.c:1014)
==24322==    by 0x5707F4A: clutter_paint_node_paint (clutter-paint-node.c:1021)
==24322==    by 0x56BB62E: clutter_actor_paint (clutter-actor.c:4110)
==24322==    by 0x56BBEE5: clutter_actor_real_paint (clutter-actor.c:3819)
==24322==    by 0x56B41FF: clutter_actor_continue_paint (clutter-actor.c:4174)
==24322==  Address 0x1ffeffc7fc is on thread 1's stack
==24322==  988 bytes below stack pointer

Merge request reports