Skip to content

Crash with "large" .svg #143

@Happlo

Description

@Happlo

This svg will crash with access violation with the following call:
auto bitmap = pDoc->renderToBitmap(0, 0, 0xFFFFFFFF);

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 111113 148163" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;">
<path d="M46667,131.25l-32107.6,148017l-11540.1,-0l32104,-148148l11543.7,130.938l0,0.729l0.033,-0.071l0.009,-0.346Z" style="fill:url("#_Linear1");"/>
<path d="M35102.4,131.25l-32107.6,148017l-2994.81,-0l32104,-148148l2998.39,130.938l-0,0.729l0.033,-0.071l0.008,-0.346Z" style="fill:url("#_Linear2");"/>
<defs>
<linearGradient id="_Linear1" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(31363.7,-143815,143815,31363.7,61390.8,146891)">
<stop offset="0" style="stop-color:#b6b8dc;stop-opacity:0.25"/>
<stop offset="1" style="stop-color:#b6b8dc;stop-opacity:0.06"/></linearGradient><linearGradient id="_Linear2" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(31363.7,-143815,143815,31363.7,61263.8,146891)">
<stop offset="0" style="stop-color:#065fde;stop-opacity:1"/><stop offset="1" style="stop-color:#b6b8dc;stop-opacity:0.25"/></linearGradient></defs></svg>

The issue seems to be unsigned integer overflow here: https://github.com/sammycage/lunasvg/blob/master/source/lunasvg.cpp#L28 and the access violation will happen in the loop inside Bitmap::clear().
It is possible to work around this issue by manually specifying width and height in renderToBitmap() but it would be nicer to have an exception thrown or something else rather than get an access violation crash.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingenhancementNew feature or requestwontfixThis will not be worked on

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions