Skip to content

Commit e946b5e

Browse files
authored
cairo: fix raster_fuzzer — remove PDF API calls that prevent acquire callback (google#15086)
## Summary The `raster_fuzzer` harness is intended to test cairo's raster source pattern mechanism (the `acquire`/`release` callbacks). However, two misplaced calls to PDF-surface-specific APIs on an image surface **contaminate the surface's error state**, causing `cairo_paint()` to short-circuit. As a result, **the `acquire` callback is never triggered, and the harness's core testing target is completely dead code.** ## Root Cause In `raster_fuzzer.c`, lines 61–62: ```c cairo_pdf_surface_set_page_label(surface, buf); cairo_pdf_surface_set_metadata(surface, CAIRO_PDF_METADATA_KEYWORDS, buf); ``` Here, `surface` is an image surface created by `cairo_image_surface_create_from_png()`. These two functions are designed exclusively for PDF surfaces. Internally, they call `_extract_pdf_surface()`, which checks whether the surface is paginated. When it is not, it sets the surface's error status to `CAIRO_STATUS_SURFACE_TYPE_MISMATCH`: ```c // cairo-pdf-surface.c: _extract_pdf_surface() if (! _cairo_surface_is_paginated (surface)) { status_ignored = _cairo_surface_set_error (surface, _cairo_error (CAIRO_STATUS_SURFACE_TYPE_MISMATCH)); return FALSE; } ``` Once the surface enters this error state, `cairo_paint()` checks the target surface status and **short-circuits without performing any drawing** — so the raster source `acquire` callback is never invoked. ## Verification I wrote a standalone test program that isolates the issue: **Without PDF calls:** ``` Surface status before paint: no error has occurred ACQUIRE CALLBACK TRIGGERED (call #1) RELEASE CALLBACK TRIGGERED acquire_called after paint: 1 ``` **With PDF calls on image surface:** ``` Surface status AFTER pdf_set_page_label: the surface type is not appropriate for the operation acquire_called after paint: 0 ``` The acquire callback fires normally without the PDF calls, but is **never triggered** when the PDF calls are present. ## Coverage Comparison (600s each) | Metric | Original | Fixed | Diff | |--------|----------|-------|------| | Line coverage | 0.57% | 0.65% | +0.08 | | Function coverage | 1.12% | 1.28% | +0.16 | | Branch coverage | 0.27% | 0.30% | +0.03 | ## Fix Remove the two PDF-specific calls and the unnecessary `#include <cairo-pdf.h>`. This allows `cairo_paint()` to proceed normally, triggering the acquire/release callbacks as intended.
1 parent 0aa33e1 commit e946b5e

1 file changed

Lines changed: 0 additions & 3 deletions

File tree

projects/cairo/targets/raster_fuzzer.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
// limitations under the License.
1414

1515
#include <cairo.h>
16-
#include <cairo-pdf.h>
1716
#include "fuzzer_temp_file.h"
1817

1918
static cairo_surface_t *
@@ -58,8 +57,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
5857
pattern = cairo_pattern_create_raster_source(buf, content, w, h);
5958
cairo_raster_source_pattern_set_acquire (pattern, acquire, release);
6059
cairo_set_source(cr, pattern);
61-
cairo_pdf_surface_set_page_label(surface, buf);
62-
cairo_pdf_surface_set_metadata(surface, CAIRO_PDF_METADATA_KEYWORDS, buf);
6360
cairo_paint(cr);
6461

6562
cairo_destroy(cr);

0 commit comments

Comments
 (0)