librsvg r1184 - trunk

[doml svn gnome org]

Author: doml
Date: Mon Oct 20 14:39:27 2008
New Revision: 1184
URL: http://svn.gnome.org/viewvc/librsvg?rev=1184&view=rev

Log:
2008-10-20  Dominic Lachowicz <domlachowicz gmail com>

        * rsvg-structure.c: Stop crash due to recursive references (#518640).
        Patch by Tom Parker
        * rsvg-private.h: ditto
        * rsvg-base.c: ditto
        * rsvg-cairo-render.c: ditto



Modified:
   trunk/ChangeLog
   trunk/rsvg-base.c
   trunk/rsvg-cairo-render.c
   trunk/rsvg-private.h
   trunk/rsvg-structure.c

Modified: trunk/rsvg-base.c
==============================================================================
--- trunk/rsvg-base.c	(original)
+++ trunk/rsvg-base.c	Mon Oct 20 14:39:27 2008
@@ -1147,6 +1147,8 @@
 	/* the drawsub stack's nodes are owned by the ->defs */
 	g_slist_free (handle->drawsub_stack);
 
+    g_slist_free (handle->ptrs);
+	
     if (handle->base_uri)
         g_free (handle->base_uri);
 
@@ -1324,6 +1326,7 @@
     RsvgBbox output;
     RsvgBboxRender *render = rsvg_bbox_render_new ();
     ctx->drawsub_stack = NULL;
+    ctx->ptrs = NULL;
     ctx->render = (RsvgRender *) render;
 
     ctx->state = NULL;

Modified: trunk/rsvg-cairo-render.c
==============================================================================
--- trunk/rsvg-cairo-render.c	(original)
+++ trunk/rsvg-cairo-render.c	Mon Oct 20 14:39:27 2008
@@ -151,6 +151,7 @@
     draw->vb.h = data.ex;
     draw->pango_context = NULL;
     draw->drawsub_stack = NULL;
+    draw->ptrs = NULL;
 
     rsvg_state_push (draw);
     state = rsvg_state_current (draw);

Modified: trunk/rsvg-private.h
==============================================================================
--- trunk/rsvg-private.h	(original)
+++ trunk/rsvg-private.h	Mon Oct 20 14:39:27 2008
@@ -187,6 +187,7 @@
     RsvgViewBox vb;
     GSList *vb_stack;
     GSList *drawsub_stack;
+    GSList *ptrs;
 };
 
 /*Abstract base class for context for our backends (one as yet)*/

Modified: trunk/rsvg-structure.c
==============================================================================
--- trunk/rsvg-structure.c	(original)
+++ trunk/rsvg-structure.c	Mon Oct 20 14:39:27 2008
@@ -50,8 +50,25 @@
     if (!state->visible)
         return;
 
+    if (g_slist_find(ctx->ptrs, self) != NULL)
+    {
+        /*
+         * 5.3.1 of the SVG 1.1 spec (http://www.w3.org/TR/SVG11/struct.html#HeadOverview)
+         * seems to indicate ("URI references that directly or indirectly reference
+         * themselves are treated as invalid circular references") that circular
+         * references are invalid, and so we can drop them to avoid infinite recursion.
+         * 
+         * See also http://bugzilla.gnome.org/show_bug.cgi?id=518640
+         */
+        g_warning("Circular SVG reference noticed, dropping");
+        return;
+    }
+    ctx->ptrs = g_slist_append(ctx->ptrs, self);
+
     self->draw (self, ctx, dominate);
     ctx->drawsub_stack = stacksave;
+
+    ctx->ptrs = g_slist_remove(ctx->ptrs, self);
 }
 
 /* generic function for drawing all of the children of a particular node */