GitLab

This file from the SVG 1.1 test suite crashes librsvg:

thread '<unnamed>' panicked at 'assertion failed: l > 0', src/parsers.rs:187:37
stack backtrace:
   0: std::sys::imp::backtrace::tracing::imp::unwind_backtrace
             at src/libstd/sys/unix/backtrace/tracing/gcc_s.rs:49
   1: std::panicking::default_hook::{{closure}}
             at src/libstd/sys_common/backtrace.rs:71
   2: std::panicking::rust_panic_with_hook
             at src/libstd/panicking.rs:396
             at src/libstd/panicking.rs:611
   3: std::panicking::begin_panic_new
   4: rsvg_internals::parsers::number_list
   5: rsvg_css_parse_number_list
   6: rsvg_filter_primitive_convolve_matrix_set_atts
             at /usr/src/packages/BUILD/librsvg-2.42.2/rsvg-filter.c:1329
   7: <rsvg_internals::cnode::CNode as rsvg_internals::node::NodeTrait>::set_atts
   8: rsvg_node_set_atts
   9: rsvg_standard_element_start

We are not initializing RsvgFilterPrimitiveConvolveMatrix.{orderx, ordery} to the default of 3 as per the spec: https://www.w3.org/TR/SVG/filters.html#feConvolveMatrixElementOrderAttribute

Since these values are 0, rsvg_css_parse_number_list() gets passed 0 for the list size and it asserts.