Commit 06bd4e08 authored by Dom Lachowicz's avatar Dom Lachowicz

Bug #330008 - prevent crashes and other bad behavior by checking

return values. Inspired by work done by Daniel Drake (dsd@gentoo.org)
parent f76ed94e
2006-02-05 Dom Lachowicz <cinamod@hotmail.com>
* rsvg-base-file-util.c: Bug #330008 - prevent crashes and other bad behavior by checking
return values. Inspired by work done by Daniel Drake (dsd@gentoo.org)
* rsvg-base.c, rsvg-convert.c, rsvg-defs.c, rsvg-file-util.c, rsvg.c, test-display.c: Ditto
2006-02-05 Caleb Moore <c.moore@student.unsw.edu.au>
* rsvg.in, configure.in: committed two patches from Daniel Drake in regards to our python rsvg script.
......
......@@ -54,7 +54,10 @@ RsvgHandle * rsvg_handle_new_from_data (const guint8 *data,
g_object_unref(G_OBJECT(handle));
handle = NULL;
} else {
rsvg_handle_close(handle, error);
if(!rsvg_handle_close(handle, error)) {
g_object_unref (G_OBJECT(handle));
handle = NULL;
}
}
}
......
......@@ -781,8 +781,9 @@ rsvg_handle_write_impl (RsvgHandle *handle,
gsize count,
GError **error)
{
GError *real_error;
GError *real_error = NULL;
g_return_val_if_fail (handle != NULL, FALSE);
int result;
handle->error = &real_error;
if (handle->ctxt == NULL)
......@@ -791,15 +792,21 @@ rsvg_handle_write_impl (RsvgHandle *handle,
handle->ctxt->replaceEntities = TRUE;
}
xmlParseChunk (handle->ctxt, (char*)buf, count, 0);
result = xmlParseChunk (handle->ctxt, (char*)buf, count, 0);
if (result != 0) {
g_set_error (error, rsvg_error_quark (), 0,
_("Error parsing XML data"));
return FALSE;
}
handle->error = NULL;
/* FIXME: Error handling not implemented. */
/* if (*real_error != NULL)
if (real_error != NULL)
{
g_propagate_error (error, real_error);
return FALSE;
}*/
g_propagate_error (error, real_error);
return FALSE;
}
return TRUE;
}
......@@ -807,31 +814,37 @@ static gboolean
rsvg_handle_close_impl (RsvgHandle *handle,
GError **error)
{
GError *real_error;
GError *real_error = NULL;
handle->error = &real_error;
if (handle->ctxt != NULL)
{
xmlDocPtr xmlDoc;
int result;
xmlDoc = handle->ctxt->myDoc;
xmlParseChunk (handle->ctxt, "", 0, TRUE);
result = xmlParseChunk (handle->ctxt, "", 0, TRUE);
xmlFreeParserCtxt (handle->ctxt);
xmlFreeDoc(xmlDoc);
if (result != 0) {
g_set_error (error, rsvg_error_quark (), 0,
_("Error parsing XML data"));
return FALSE;
}
}
/* FIXME: Error handling not implemented. */
/*
if (real_error != NULL)
{
g_propagate_error (error, real_error);
return FALSE;
}*/
rsvg_defs_resolve_all(handle->defs);
handle->finished = TRUE;
handle->error = NULL;
if (real_error != NULL)
{
g_propagate_error (error, real_error);
return FALSE;
}
return TRUE;
}
......
......@@ -78,7 +78,11 @@ rsvg_handle_new_from_stdio_file (FILE * f,
}
}
rsvg_handle_close (handle, error);
if(!rsvg_handle_close (handle, error)) {
g_object_unref(G_OBJECT(handle));
return NULL;
}
base_uri = g_get_current_dir ();
rsvg_handle_set_base_uri (handle, base_uri);
g_free (base_uri);
......
......@@ -88,12 +88,12 @@ rsvg_defs_load_extern(const RsvgDefs *defs, const char *name)
rsvg_handle_set_base_uri (handle, base_uri);
g_free(base_uri);
rsvg_handle_write (handle, chars->data, chars->len, NULL);
g_byte_array_free (chars, TRUE);
rsvg_handle_close (handle, NULL);
g_hash_table_insert (defs->externs, g_strdup (name), handle);
if(rsvg_handle_write (handle, chars->data, chars->len, NULL) &&
rsvg_handle_close (handle, NULL)) {
g_hash_table_insert (defs->externs, g_strdup (name), handle);
}
g_byte_array_free (chars, TRUE);
}
g_free(filename);
......
......@@ -138,12 +138,18 @@ rsvg_pixbuf_from_data_with_size_data (const guchar * buff,
}
rsvg_handle_set_size_callback (handle, _rsvg_size_callback, data, NULL);
rsvg_handle_set_base_uri (handle, base_uri);
rsvg_handle_write (handle, buff, len, error);
if (!rsvg_handle_write (handle, buff, len, error)) {
g_object_unref(G_OBJECT(handle));
return NULL;
}
if(!rsvg_handle_close (handle, error)) {
g_object_unref(G_OBJECT(handle));
return NULL;
}
rsvg_handle_close (handle, error);
retval = rsvg_handle_get_pixbuf (handle);
g_object_unref (G_OBJECT(handle));
......@@ -168,12 +174,18 @@ rsvg_pixbuf_from_stdio_file_with_size_data(GByteArray *f,
}
rsvg_handle_set_size_callback (handle, _rsvg_size_callback, data, NULL);
rsvg_handle_set_base_uri(handle, base_uri);
rsvg_handle_write (handle, f->data, f->len, error);
if (!rsvg_handle_write (handle, f->data, f->len, error)) {
g_object_unref (G_OBJECT(handle));
return NULL;
}
if (!rsvg_handle_close (handle, error)) {
g_object_unref(G_OBJECT(handle));
return NULL;
}
rsvg_handle_close (handle, error);
retval = rsvg_handle_get_pixbuf (handle);
g_object_unref (G_OBJECT(handle));
......
......@@ -305,8 +305,10 @@ rsvg_handle_free (RsvgHandle *handle)
*
* Returns a new rsvg handle. Must be freed with @rsvg_handle_free. This
* handle can be used for dynamically loading an image. You need to feed it
* data using @rsvg_handle_write, then call @rsvg_handle_close when done. No
* more than one image can be loaded with one handle.
* data using @rsvg_handle_write, then call @rsvg_handle_close when done.
* Afterwords, you can render it using Cairo or get a GdkPixbuf from it. When
* finished, free with g_object_unref(). No more than one image can be loaded
* with one handle.
*
* Returns: A new #RsvgHandle
**/
......
......@@ -80,6 +80,9 @@ rsvg_handle_get_pixbuf_sub (RsvgHandle *handle, const char * id)
return NULL;
rsvg_handle_get_dimensions (handle, &dimensions);
if(!(dimensions.width && dimensions.height))
return NULL;
rowstride = dimensions.width * 4;
pixels = g_new0(guint8, dimensions.width * dimensions.height * 4);
......
......@@ -822,11 +822,11 @@ main (int argc, char **argv)
if (!info.pixbuf)
{
g_critical (_("Error displaying pixbuf!\n"));
g_print (_("Error displaying pixbuf!\n"));
if (err)
{
g_critical (err->message);
g_print ("%s\n", err->message);
g_error_free (err);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment