search

sammycage / lunasvg

lunasvg is a standalone SVG rendering library in C++
MIT License
818 stars 115 forks source link

Crash with "large" .svg #143

Open Happlo opened 8 months ago

Happlo commented 8 months ago

This svg will crash with access violation with the following call: auto bitmap = pDoc->renderToBitmap(0, 0, 0xFFFFFFFF);

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 111113 148163" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;">
<path d="M46667,131.25l-32107.6,148017l-11540.1,-0l32104,-148148l11543.7,130.938l0,0.729l0.033,-0.071l0.009,-0.346Z" style="fill:url(#_Linear1);"/>
<path d="M35102.4,131.25l-32107.6,148017l-2994.81,-0l32104,-148148l2998.39,130.938l-0,0.729l0.033,-0.071l0.008,-0.346Z" style="fill:url(#_Linear2);"/>
<defs>
<linearGradient id="_Linear1" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(31363.7,-143815,143815,31363.7,61390.8,146891)">
<stop offset="0" style="stop-color:#b6b8dc;stop-opacity:0.25"/>
<stop offset="1" style="stop-color:#b6b8dc;stop-opacity:0.06"/></linearGradient><linearGradient id="_Linear2" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(31363.7,-143815,143815,31363.7,61263.8,146891)">
<stop offset="0" style="stop-color:#065fde;stop-opacity:1"/><stop offset="1" style="stop-color:#b6b8dc;stop-opacity:0.25"/></linearGradient></defs></svg>

The issue seems to be unsigned integer overflow here: https://github.com/sammycage/lunasvg/blob/master/source/lunasvg.cpp#L28 and the access violation will happen in the loop inside Bitmap::clear(). It is possible to work around this issue by manually specifying width and height in renderToBitmap() but it would be nicer to have an exception thrown or something else rather than get an access violation crash.