-
-
Notifications
You must be signed in to change notification settings - Fork 146
Closed
Labels
bugSomething isn't workingSomething isn't workingenhancementNew feature or requestNew feature or requestwontfixThis will not be worked onThis will not be worked on
Description
This svg will crash with access violation with the following call:
auto bitmap = pDoc->renderToBitmap(0, 0, 0xFFFFFFFF);
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 111113 148163" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;">
<path d="M46667,131.25l-32107.6,148017l-11540.1,-0l32104,-148148l11543.7,130.938l0,0.729l0.033,-0.071l0.009,-0.346Z" style="fill:url("#_Linear1");"/>
<path d="M35102.4,131.25l-32107.6,148017l-2994.81,-0l32104,-148148l2998.39,130.938l-0,0.729l0.033,-0.071l0.008,-0.346Z" style="fill:url("#_Linear2");"/>
<defs>
<linearGradient id="_Linear1" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(31363.7,-143815,143815,31363.7,61390.8,146891)">
<stop offset="0" style="stop-color:#b6b8dc;stop-opacity:0.25"/>
<stop offset="1" style="stop-color:#b6b8dc;stop-opacity:0.06"/></linearGradient><linearGradient id="_Linear2" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(31363.7,-143815,143815,31363.7,61263.8,146891)">
<stop offset="0" style="stop-color:#065fde;stop-opacity:1"/><stop offset="1" style="stop-color:#b6b8dc;stop-opacity:0.25"/></linearGradient></defs></svg>
The issue seems to be unsigned integer overflow here: https://github.com/sammycage/lunasvg/blob/master/source/lunasvg.cpp#L28 and the access violation will happen in the loop inside Bitmap::clear().
It is possible to work around this issue by manually specifying width and height in renderToBitmap() but it would be nicer to have an exception thrown or something else rather than get an access violation crash.
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't workingenhancementNew feature or requestNew feature or requestwontfixThis will not be worked onThis will not be worked on