Skip to content

Commit

Permalink
Fix for #185
Browse files Browse the repository at this point in the history
- prevent infinite loop when gradient ID is left to empty string
- prevent infinite loop when gradient references to self
- lookup up to 32 references back
  • Loading branch information
memononen committed Sep 28, 2020
1 parent e7f5981 commit ddd39e9
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 3 deletions.
2 changes: 1 addition & 1 deletion example/example2.c
Expand Up @@ -32,7 +32,7 @@ int main()
NSVGrasterizer *rast = NULL;
unsigned char* img = NULL;
int w, h;
const char* filename = "../example/23.svg";
const char* filename = "../example/_timeout_2.svg";

This comment has been minimized.

Copy link
@invd

invd Sep 28, 2020

@memononen FYI: this looks like an unintended change related to debugging to me since there is no new _timeout_2.svg file.


printf("parsing %s\n", filename);
image = nsvgParseFromFile(filename, "px", 96.0f);
Expand Down
13 changes: 11 additions & 2 deletions src/nanosvg.h
Expand Up @@ -805,7 +805,9 @@ static float nsvg__convertToPixels(NSVGparser* p, NSVGcoordinate c, float orig,
static NSVGgradientData* nsvg__findGradientData(NSVGparser* p, const char* id)
{
NSVGgradientData* grad = p->gradients;
while (grad) {
if (id == NULL || *id == '\0')
return NULL;
while (grad != NULL) {
if (strcmp(grad->id, id) == 0)
return grad;
grad = grad->next;
Expand All @@ -822,19 +824,26 @@ static NSVGgradient* nsvg__createGradient(NSVGparser* p, const char* id, const f
NSVGgradient* grad;
float ox, oy, sw, sh, sl;
int nstops = 0;
int refIter;

data = nsvg__findGradientData(p, id);
if (data == NULL) return NULL;

// TODO: use ref to fill in all unset values too.
ref = data;
refIter = 0;
while (ref != NULL) {
NSVGgradientData* nextRef = NULL;
if (stops == NULL && ref->stops != NULL) {
stops = ref->stops;
nstops = ref->nstops;
break;
}
ref = nsvg__findGradientData(p, ref->ref);
nextRef = nsvg__findGradientData(p, ref->ref);
if (nextRef == ref) break; // prevent infite loops on malformed data
ref = nextRef;
refIter++;
if (refIter > 32) break; // prevent infite loops on malformed data
}
if (stops == NULL) return NULL;

Expand Down

0 comments on commit ddd39e9

Please sign in to comment.