cheng/nanosvg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #182 from oehhar/master

Browse Source 
Ticket #178: endless loop (DOS) when parsing crafted input via nsvgPa…
This commit is contained in:
Mikko Mononen 2020-09-21 20:57:26 +03:00 committed by GitHub
commit 07a5e2a33c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/nanosvg.h
View File

@ -1597,25 +1597,32 @@ static int nsvg__parseRotate(float* xform, const char* str)
static void nsvg__parseTransform(float* xform, const char* str) static void nsvg__parseTransform(float* xform, const char* str)
{ {
float t[6]; float t[6];
int len;
nsvg__xformIdentity(xform); nsvg__xformIdentity(xform);
while (*str) while (*str)
{ {
if (strncmp(str, "matrix", 6) == 0) if (strncmp(str, "matrix", 6) == 0)
str += nsvg__parseMatrix(t, str); len = nsvg__parseMatrix(t, str);
else if (strncmp(str, "translate", 9) == 0) else if (strncmp(str, "translate", 9) == 0)
str += nsvg__parseTranslate(t, str); len = nsvg__parseTranslate(t, str);
else if (strncmp(str, "scale", 5) == 0) else if (strncmp(str, "scale", 5) == 0)
str += nsvg__parseScale(t, str); len = nsvg__parseScale(t, str);
else if (strncmp(str, "rotate", 6) == 0) else if (strncmp(str, "rotate", 6) == 0)
str += nsvg__parseRotate(t, str); len = nsvg__parseRotate(t, str);
else if (strncmp(str, "skewX", 5) == 0) else if (strncmp(str, "skewX", 5) == 0)
str += nsvg__parseSkewX(t, str); len = nsvg__parseSkewX(t, str);
else if (strncmp(str, "skewY", 5) == 0) else if (strncmp(str, "skewY", 5) == 0)
str += nsvg__parseSkewY(t, str); len = nsvg__parseSkewY(t, str);
else{ else{
++str; ++str;
continue; continue;
} }
if (len != 0) {
str += len;
} else {
++str;
continue;
}
nsvg__xformPremultiply(xform, t); nsvg__xformPremultiply(xform, t);
} }