Commit d937c691 authored by Benjamin Otte's avatar Benjamin Otte

Don't crash when filters don't exist

We put a new surface on the stack if a filter existed by name but we
didn't pop it if the name didn't resolve to a real filter.

New test: crash/bug759084.svg

https://bugzilla.gnome.org/show_bug.cgi?id=759084
parent 91e50fe3
......@@ -819,10 +819,10 @@ rsvg_cairo_pop_render_stack (RsvgDrawingCtx * ctx)
cairo_surface_t *output;
filter = rsvg_acquire_node (ctx, state->filter);
if (filter && RSVG_NODE_TYPE (filter) == RSVG_NODE_TYPE_FILTER) {
output = render->surfaces_stack->data;
render->surfaces_stack = g_list_delete_link (render->surfaces_stack, render->surfaces_stack);
output = render->surfaces_stack->data;
render->surfaces_stack = g_list_delete_link (render->surfaces_stack, render->surfaces_stack);
if (filter && RSVG_NODE_TYPE (filter) == RSVG_NODE_TYPE_FILTER) {
needs_destroy = TRUE;
surface = rsvg_filter_render ((RsvgFilter *) filter, output, ctx, &render->bbox, "2103");
/* Don't destroy the output surface, it's owned by child_cr */
......
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10">
<defs>
<filter id="filter">
</filter>
</defs>
<g filter="url(#filter)">
<rect fill="red" width="10" height="10" filter="url(#doesnotexist)" />
</g>
</svg>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment