[librsvg/librsvg-2.40] rsvg_parse_transform(): Return failure for degenerate matrices

[Federico Mena Quintero <federico src gnome org>]

commit 5a64b032d3dfbecd1af0ecea0fc5e636029547b3
Author: Federico Mena Quintero <federico gnome org>
Date:   Fri Jul 7 10:40:05 2017 -0500

    rsvg_parse_transform(): Return failure for degenerate matrices

 rsvg-styles.c |   34 ++++++++++++++++++++++++----------
 1 files changed, 24 insertions(+), 10 deletions(-)
---
diff --git a/rsvg-styles.c b/rsvg-styles.c
index 948333e..61e2841 100644
--- a/rsvg-styles.c
+++ b/rsvg-styles.c
@@ -1241,6 +1241,7 @@ rsvg_parse_transform (cairo_matrix_t *dst, const char *src)
     int n_args;
     guint key_len;
     cairo_matrix_t affine;
+    cairo_matrix_t inverse;
 
     cairo_matrix_init_identity (dst);
 
@@ -1264,7 +1265,8 @@ rsvg_parse_transform (cairo_matrix_t *dst, const char *src)
                 break;
         }
         if (key_len >= sizeof (keyword))
-            return FALSE;
+            goto invalid;
+
         keyword[key_len] = '\0';
 
         /* skip whitespace */
@@ -1272,7 +1274,8 @@ rsvg_parse_transform (cairo_matrix_t *dst, const char *src)
             idx++;
 
         if (src[idx] != '(')
-            return FALSE;
+            goto invalid;
+
         idx++;
 
         for (n_args = 0;; n_args++) {
@@ -1285,7 +1288,8 @@ rsvg_parse_transform (cairo_matrix_t *dst, const char *src)
             c = src[idx];
             if (g_ascii_isdigit (c) || c == '+' || c == '-' || c == '.') {
                 if (n_args == sizeof (args) / sizeof (args[0]))
-                    return FALSE;       /* too many args */
+                    goto invalid;
+
                 args[n_args] = g_ascii_strtod (src + idx, &end_ptr);
                 idx = end_ptr - src;
 
@@ -1298,7 +1302,7 @@ rsvg_parse_transform (cairo_matrix_t *dst, const char *src)
             } else if (c == ')')
                 break;
             else
-                return FALSE;
+                goto invalid;
         }
         idx++;
 
@@ -1313,14 +1317,14 @@ rsvg_parse_transform (cairo_matrix_t *dst, const char *src)
             if (n_args == 1)
                 args[1] = 0;
             else if (n_args != 2)
-                return FALSE;
+                goto invalid;
             cairo_matrix_init_translate (&affine, args[0], args[1]);
             cairo_matrix_multiply (dst, &affine, dst);
         } else if (!strcmp (keyword, "scale")) {
             if (n_args == 1)
                 args[1] = args[0];
             else if (n_args != 2)
-                return FALSE;
+                goto invalid;
             cairo_matrix_init_scale (&affine, args[0], args[1]);
             cairo_matrix_multiply (dst, &affine, dst);
         } else if (!strcmp (keyword, "rotate")) {
@@ -1338,24 +1342,34 @@ rsvg_parse_transform (cairo_matrix_t *dst, const char *src)
                 cairo_matrix_init_translate (&affine, -args[1], -args[2]);
                 cairo_matrix_multiply (dst, &affine, dst);
             } else
-                return FALSE;
+                goto invalid;
         } else if (!strcmp (keyword, "skewX")) {
             if (n_args != 1)
-                return FALSE;
+                goto invalid;
             _rsvg_cairo_matrix_init_shear (&affine, args[0]);
             cairo_matrix_multiply (dst, &affine, dst);
         } else if (!strcmp (keyword, "skewY")) {
             if (n_args != 1)
-                return FALSE;
+                goto invalid;
             _rsvg_cairo_matrix_init_shear (&affine, args[0]);
             /* transpose the affine, given that we know [1] is zero */
             affine.yx = affine.xy;
             affine.xy = 0.;
             cairo_matrix_multiply (dst, &affine, dst);
         } else
-            return FALSE;       /* unknown keyword */
+            goto invalid;       /* unknown keyword */
     }
+
+    inverse = *dst;
+    if (cairo_matrix_invert (&inverse) != CAIRO_STATUS_SUCCESS)
+        goto invalid;
+
     return TRUE;
+
+invalid:
+
+    cairo_matrix_init_identity (dst);
+    return FALSE;
 }
 
 /**