cheng/nanosvg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ticket #178: endless loop (DOS) when parsing crafted input via nsvgParseFromFile()

Browse Source 
Fix be fvogel
This commit is contained in:
Harald Oehlmann 2020-09-21 13:53:54 +02:00
parent 25241c5a8f
commit dac455fd94
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/nanosvg.h
View File

@ -1597,25 +1597,32 @@ static int nsvg__parseRotate(float* xform, const char* str)
static void nsvg__parseTransform(float* xform, const char* str) static void nsvg__parseTransform(float* xform, const char* str)
{ {
float t[6]; float t[6];
int len;
nsvg__xformIdentity(xform); nsvg__xformIdentity(xform);
while (*str) while (*str)
{ {
if (strncmp(str, "matrix", 6) == 0) if (strncmp(str, "matrix", 6) == 0)
str += nsvg__parseMatrix(t, str); len = nsvg__parseMatrix(t, str);
else if (strncmp(str, "translate", 9) == 0) else if (strncmp(str, "translate", 9) == 0)
str += nsvg__parseTranslate(t, str); len = nsvg__parseTranslate(t, str);
else if (strncmp(str, "scale", 5) == 0) else if (strncmp(str, "scale", 5) == 0)
str += nsvg__parseScale(t, str); len = nsvg__parseScale(t, str);
else if (strncmp(str, "rotate", 6) == 0) else if (strncmp(str, "rotate", 6) == 0)
str += nsvg__parseRotate(t, str); len = nsvg__parseRotate(t, str);
else if (strncmp(str, "skewX", 5) == 0) else if (strncmp(str, "skewX", 5) == 0)
str += nsvg__parseSkewX(t, str); len = nsvg__parseSkewX(t, str);
else if (strncmp(str, "skewY", 5) == 0) else if (strncmp(str, "skewY", 5) == 0)
str += nsvg__parseSkewY(t, str); len = nsvg__parseSkewY(t, str);
else{ else{
++str; ++str;
continue; continue;
} }
if (len != 0) {
str += len;
} else {
++str;
continue;
}
nsvg__xformPremultiply(xform, t); nsvg__xformPremultiply(xform, t);
} }