xcb,xlib,surface: Check for too small sizes

This adds checks for negative sizes in cairo_surface_create_similar() and for
non-positive sizes in all public surface-creation functions in the xcb and xlib
backends.

X11 doesn't allow 0 as width/height, so if anyone claims to have a drawable of
that size, he can't be right. However, cairo allows such sizes which is why
create_similar doesn't reject 0.

Signed-off-by: Uli Schlachter <psychon@znc.in>

3 files changed, 14 insertions, 6 deletions

diff --git a/src/cairo-surface.c b/src/cairo-surface.c
index 91a5c506..695a63b5 100644
--- a/src/cairo-surface.c
+++ b/src/cairo-surface.c
@@ -502,6 +502,8 @@ cairo_surface_create_similar (cairo_surface_t  *other,
 	return _cairo_surface_create_in_error (other->status);
     if (unlikely (other->finished))
 	return _cairo_surface_create_in_error (CAIRO_STATUS_SURFACE_FINISHED);
+    if (unlikely (width < 0 || height < 0))
+	return _cairo_surface_create_in_error (CAIRO_STATUS_INVALID_SIZE);
 
     if (unlikely (! CAIRO_CONTENT_VALID (content)))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_CONTENT));
diff --git a/src/cairo-xcb-surface.c b/src/cairo-xcb-surface.c
index 62787738..a711d123 100644
--- a/src/cairo-xcb-surface.c
+++ b/src/cairo-xcb-surface.c
@@ -1187,6 +1187,8 @@ cairo_xcb_surface_create (xcb_connection_t  *xcb_connection,
 
     if (unlikely (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
+    if (unlikely (width <= 0 || height <= 0))
+	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
 
     xcb_screen = _cairo_xcb_screen_from_visual (xcb_connection, visual, &depth);
     if (unlikely (xcb_screen == NULL))
@@ -1261,6 +1263,8 @@ cairo_xcb_surface_create_for_bitmap (xcb_connection_t	*xcb_connection,
 
     if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
+    if (unlikely (width <= 0 || height <= 0))
+	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
 
     screen = _cairo_xcb_screen_get (xcb_connection, xcb_screen);
     if (unlikely (screen == NULL))
@@ -1323,6 +1327,8 @@ cairo_xcb_surface_create_with_xrender_format (xcb_connection_t	    *xcb_connecti
 
     if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
+    if (unlikely (width <= 0 || height <= 0))
+	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
 
     image_masks.alpha_mask =
 	(unsigned long) format->direct.alpha_mask << format->direct.alpha_shift;
@@ -1402,7 +1408,7 @@ cairo_xcb_surface_set_size (cairo_surface_t *abstract_surface,
 	return;
     }
 
-    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX) {
+    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX || width <= 0 || height <= 0) {
 	status_ignored = _cairo_surface_set_error (abstract_surface,
 						   _cairo_error (CAIRO_STATUS_INVALID_SIZE));
 	return;
diff --git a/src/cairo-xlib-surface.c b/src/cairo-xlib-surface.c
index f8caf83a..1747be21 100644
--- a/src/cairo-xlib-surface.c
+++ b/src/cairo-xlib-surface.c
@@ -3370,7 +3370,7 @@ cairo_xlib_surface_create (Display     *dpy,
     cairo_xlib_screen_t *screen;
     cairo_status_t status;
 
-    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX) {
+    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX || width <= 0 || height <= 0) {
 	/* you're lying, and you know it! */
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
     }
@@ -3413,7 +3413,7 @@ cairo_xlib_surface_create_for_bitmap (Display  *dpy,
     cairo_xlib_screen_t *screen;
     cairo_status_t status;
 
-    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX)
+    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX || width <= 0 || height <= 0)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
 
     status = _cairo_xlib_screen_get (dpy, scr, &screen);
@@ -3459,7 +3459,7 @@ cairo_xlib_surface_create_with_xrender_format (Display		    *dpy,
     cairo_xlib_screen_t *screen;
     cairo_status_t status;
 
-    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX)
+    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX || width <= 0 || height <= 0)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
 
     status = _cairo_xlib_screen_get (dpy, scr, &screen);
@@ -3541,7 +3541,7 @@ cairo_xlib_surface_set_size (cairo_surface_t *abstract_surface,
 	return;
     }
 
-    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX) {
+    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX || width <= 0 || height <= 0) {
 	status = _cairo_surface_set_error (abstract_surface,
 		                           _cairo_error (CAIRO_STATUS_INVALID_SIZE));
 	return;
@@ -3587,7 +3587,7 @@ cairo_xlib_surface_set_drawable (cairo_surface_t   *abstract_surface,
 	return;
     }
 
-    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX) {
+    if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX || width <= 0 || height <= 0) {
 	status = _cairo_surface_set_error (abstract_surface,
 		                           _cairo_error (CAIRO_STATUS_INVALID_SIZE));
 	return;