external/cairo/UnpackedTarball_cairo.mk | 1 +
external/cairo/cairo/shm-null-deref.patch.1 | 14 ++++++++++++++
2 files changed, 15 insertions(+)
New commits:
commit 1f9fa0dd5b7fdf7aa5599bec6bcfa304e8654300
Author: Noel Grandin <noel.gran...@collabora.co.uk>
AuthorDate: Thu Aug 21 09:44:03 2025 +0200
Commit: Noel Grandin <noel.gran...@collabora.co.uk>
CommitDate: Thu Aug 21 12:45:28 2025 +0200
fix cairo null pointer deref
when running with internal cairo and the gen backend
Change-Id: Iec847b5f9fe97faefc1304e0e153ed81f8e1c9b1
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189983
Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
Tested-by: Jenkins
diff --git a/external/cairo/UnpackedTarball_cairo.mk
b/external/cairo/UnpackedTarball_cairo.mk
index 0fdc451a205d..a4dff6c9b9d5 100644
--- a/external/cairo/UnpackedTarball_cairo.mk
+++ b/external/cairo/UnpackedTarball_cairo.mk
@@ -33,6 +33,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,cairo,\
external/cairo/cairo/libcairo-bundled-soname.patch.0 \
external/cairo/cairo/cairo-fd-hack.patch.0 \
external/cairo/cairo/cairo.ofz57493-Timeout.patch.1 \
+ external/cairo/cairo/shm-null-deref.patch.1 \
))
ifeq ($(OS),iOS)
diff --git a/external/cairo/cairo/shm-null-deref.patch.1
b/external/cairo/cairo/shm-null-deref.patch.1
new file mode 100644
index 000000000000..b779c19b56bf
--- /dev/null
+++ b/external/cairo/cairo/shm-null-deref.patch.1
@@ -0,0 +1,14 @@
+diff -ur cairo.org/src/cairo-xlib-render-compositor.c
cairo/src/cairo-xlib-render-compositor.c
+--- cairo.org/src/cairo-xlib-render-compositor.c 2025-08-21
09:40:19.517297288 +0200
++++ cairo/src/cairo-xlib-render-compositor.c 2025-08-21 09:41:29.360415588
+0200
+@@ -377,7 +377,8 @@
+ }
+
+ out:
+- cairo_surface_destroy (&shm->base);
++ if (shm)
++ cairo_surface_destroy (&shm->base);
+ return status;
+ }
+
+
