[librsvg/librsvg-2.44: 2/7] Rename num_elements_rendered_through_use to num_elements_acquired



commit 1b63d474943e8f1fe77757ee87f2d39502e32fda
Author: Federico Mena Quintero <federico gnome org>
Date:   Thu Oct 10 15:26:14 2019 -0500

    Rename num_elements_rendered_through_use to num_elements_acquired
    
    We'll change this to be the number of elements ever acquired through
    DrawingCtx.acquire_node(), instead of just those being instanced
    through the <use> element.  It turns out one can create a pathological
    SVG file that causes an exponential number of elements to be rendered,
    without using <use>.

 rsvg_internals/src/drawing_ctx.rs | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)
---
diff --git a/rsvg_internals/src/drawing_ctx.rs b/rsvg_internals/src/drawing_ctx.rs
index c9c2d169..0d0e401b 100644
--- a/rsvg_internals/src/drawing_ctx.rs
+++ b/rsvg_internals/src/drawing_ctx.rs
@@ -101,17 +101,9 @@ pub struct DrawingCtx<'a> {
     dpi_x: f64,
     dpi_y: f64,
 
-    /// This is a mitigation for the security-related bug
-    /// https://gitlab.gnome.org/GNOME/librsvg/issues/323 - imagine
-    /// the XML [billion laughs attack], but done by creating deeply
-    /// nested groups of `<use>` elements.  The first one references
-    /// the second one ten times, the second one references the third
-    /// one ten times, and so on.  In the file given, this causes
-    /// 10^17 objects to be rendered.  While this does not exhaust
-    /// memory, it would take a really long time.
-    ///
-    /// [billion laughs attack]: https://bitbucket.org/tiran/defusedxml
-    num_elements_rendered_through_use: usize,
+    // This is a mitigation for SVG files that try to instance a huge number of
+    // elements via <use>, recursive patterns, etc.  See limits.rs for details.
+    num_elements_acquired: usize,
 
     cr_stack: Vec<cairo::Context>,
     cr: cairo::Context,
@@ -170,7 +162,7 @@ impl<'a> DrawingCtx<'a> {
             rect,
             dpi_x,
             dpi_y,
-            num_elements_rendered_through_use: 0,
+            num_elements_acquired: 0,
             cr_stack: Vec::new(),
             cr: cr.clone(),
             initial_cr: cr.clone(),
@@ -860,11 +852,11 @@ impl<'a> DrawingCtx<'a> {
     }
 
     pub fn increase_num_elements_rendered_through_use(&mut self, n: usize) {
-        self.num_elements_rendered_through_use += n;
+        self.num_elements_acquired += n;
     }
 
     fn check_limits(&self) -> Result<(), RenderingError> {
-        if self.num_elements_rendered_through_use > limits::MAX_REFERENCED_ELEMENTS {
+        if self.num_elements_acquired > limits::MAX_REFERENCED_ELEMENTS {
             Err(RenderingError::InstancingLimit)
         } else {
             Ok(())


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]