Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash with "large" .svg #143

Open
Happlo opened this issue Nov 29, 2023 · 0 comments
Open

Crash with "large" .svg #143

Happlo opened this issue Nov 29, 2023 · 0 comments
Labels
enhancement New feature or request

Comments

@Happlo
Copy link

Happlo commented Nov 29, 2023

This svg will crash with access violation with the following call:
auto bitmap = pDoc->renderToBitmap(0, 0, 0xFFFFFFFF);

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 111113 148163" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;">
<path d="M46667,131.25l-32107.6,148017l-11540.1,-0l32104,-148148l11543.7,130.938l0,0.729l0.033,-0.071l0.009,-0.346Z" style="fill:url(#_Linear1);"/>
<path d="M35102.4,131.25l-32107.6,148017l-2994.81,-0l32104,-148148l2998.39,130.938l-0,0.729l0.033,-0.071l0.008,-0.346Z" style="fill:url(#_Linear2);"/>
<defs>
<linearGradient id="_Linear1" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(31363.7,-143815,143815,31363.7,61390.8,146891)">
<stop offset="0" style="stop-color:#b6b8dc;stop-opacity:0.25"/>
<stop offset="1" style="stop-color:#b6b8dc;stop-opacity:0.06"/></linearGradient><linearGradient id="_Linear2" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(31363.7,-143815,143815,31363.7,61263.8,146891)">
<stop offset="0" style="stop-color:#065fde;stop-opacity:1"/><stop offset="1" style="stop-color:#b6b8dc;stop-opacity:0.25"/></linearGradient></defs></svg>

The issue seems to be unsigned integer overflow here: https://github.com/sammycage/lunasvg/blob/master/source/lunasvg.cpp#L28 and the access violation will happen in the loop inside Bitmap::clear().
It is possible to work around this issue by manually specifying width and height in renderToBitmap() but it would be nicer to have an exception thrown or something else rather than get an access violation crash.

@sammycage sammycage added the enhancement New feature or request label Jan 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants