[librsvg] sax_processing_instruction_cb() - Fix crash with an empty XML processing instruction



commit 2ca0108f2c6acc26b86fd19c23310937fa149ced
Author: Federico Mena Quintero <federico gnome org>
Date:   Fri May 31 12:33:05 2019 -0500

    sax_processing_instruction_cb() - Fix crash with an empty XML processing instruction
    
    Thanks to Bastien Orivel for the original fuzzed file.

 rsvg_internals/src/xml2_load.rs              | 7 +++++--
 tests/fixtures/crash/xml-pi-without-data.svg | 1 +
 2 files changed, 6 insertions(+), 2 deletions(-)
---
diff --git a/rsvg_internals/src/xml2_load.rs b/rsvg_internals/src/xml2_load.rs
index d9bbb018..01b4bdcd 100644
--- a/rsvg_internals/src/xml2_load.rs
+++ b/rsvg_internals/src/xml2_load.rs
@@ -201,8 +201,11 @@ unsafe extern "C" fn sax_processing_instruction_cb(
     assert!(!target.is_null());
     let target = utf8_cstr(target);
 
-    assert!(!data.is_null());
-    let data = utf8_cstr(data);
+    let data = if data.is_null() {
+        ""
+    } else {
+        utf8_cstr(data)
+    };
 
     xml.processing_instruction(target, data);
 }
diff --git a/tests/fixtures/crash/xml-pi-without-data.svg b/tests/fixtures/crash/xml-pi-without-data.svg
new file mode 100644
index 00000000..d97e78c6
--- /dev/null
+++ b/tests/fixtures/crash/xml-pi-without-data.svg
@@ -0,0 +1 @@
+<?b?>


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]