|
 |
1d78ed |
diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp
|
|
|
404993 |
index b3d9aaf..402a71f 100644
|
|
|
1d78ed |
--- a/src/svg/qsvghandler.cpp
|
|
|
1d78ed |
+++ b/src/svg/qsvghandler.cpp
|
|
|
404993 |
@@ -1614,6 +1614,7 @@ static void pathArc(QPainterPath &path,
|
|
|
1d78ed |
|
|
|
1d78ed |
static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
{
|
|
|
1d78ed |
+ const int maxElementCount = 0x7fff; // Assume file corruption if more path elements than this
|
|
|
1d78ed |
qreal x0 = 0, y0 = 0; // starting point
|
|
|
1d78ed |
qreal x = 0, y = 0; // current point
|
|
|
1d78ed |
char lastMode = 0;
|
|
|
404993 |
@@ -1621,7 +1622,8 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
const QChar *str = dataStr.constData();
|
|
|
1d78ed |
const QChar *end = str + dataStr.size();
|
|
|
1d78ed |
|
|
|
1d78ed |
- while (str != end) {
|
|
|
1d78ed |
+ bool ok = true;
|
|
|
1d78ed |
+ while (ok && str != end) {
|
|
|
1d78ed |
while (str->isSpace() && (str + 1) != end)
|
|
|
1d78ed |
++str;
|
|
|
1d78ed |
QChar pathElem = *str;
|
|
|
404993 |
@@ -1635,14 +1637,13 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
arg.append(0);//dummy
|
|
|
1d78ed |
const qreal *num = arg.constData();
|
|
|
1d78ed |
int count = arg.count();
|
|
|
1d78ed |
- while (count > 0) {
|
|
|
1d78ed |
+ while (ok && count > 0) {
|
|
|
1d78ed |
qreal offsetX = x; // correction offsets
|
|
|
1d78ed |
qreal offsetY = y; // for relative commands
|
|
|
1d78ed |
switch (pathElem.unicode()) {
|
|
|
1d78ed |
case 'm': {
|
|
|
1d78ed |
if (count < 2) {
|
|
|
1d78ed |
- num++;
|
|
|
1d78ed |
- count--;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
x = x0 = num[0] + offsetX;
|
|
|
404993 |
@@ -1659,8 +1660,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
case 'M': {
|
|
|
1d78ed |
if (count < 2) {
|
|
|
1d78ed |
- num++;
|
|
|
1d78ed |
- count--;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
x = x0 = num[0];
|
|
|
404993 |
@@ -1686,8 +1686,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
case 'l': {
|
|
|
1d78ed |
if (count < 2) {
|
|
|
1d78ed |
- num++;
|
|
|
1d78ed |
- count--;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
x = num[0] + offsetX;
|
|
|
404993 |
@@ -1700,8 +1699,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
case 'L': {
|
|
|
1d78ed |
if (count < 2) {
|
|
|
1d78ed |
- num++;
|
|
|
1d78ed |
- count--;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
x = num[0];
|
|
|
404993 |
@@ -1741,8 +1739,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
case 'c': {
|
|
|
1d78ed |
if (count < 6) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
QPointF c1(num[0] + offsetX, num[1] + offsetY);
|
|
|
404993 |
@@ -1758,8 +1755,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
case 'C': {
|
|
|
1d78ed |
if (count < 6) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
QPointF c1(num[0], num[1]);
|
|
|
404993 |
@@ -1775,8 +1771,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
case 's': {
|
|
|
1d78ed |
if (count < 4) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
QPointF c1;
|
|
|
404993 |
@@ -1797,8 +1792,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
case 'S': {
|
|
|
1d78ed |
if (count < 4) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
QPointF c1;
|
|
|
404993 |
@@ -1819,8 +1813,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
case 'q': {
|
|
|
1d78ed |
if (count < 4) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
QPointF c(num[0] + offsetX, num[1] + offsetY);
|
|
|
404993 |
@@ -1835,8 +1828,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
case 'Q': {
|
|
|
1d78ed |
if (count < 4) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
QPointF c(num[0], num[1]);
|
|
|
404993 |
@@ -1851,8 +1843,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
case 't': {
|
|
|
1d78ed |
if (count < 2) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
QPointF e(num[0] + offsetX, num[1] + offsetY);
|
|
|
404993 |
@@ -1872,8 +1863,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
case 'T': {
|
|
|
1d78ed |
if (count < 2) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
QPointF e(num[0], num[1]);
|
|
|
404993 |
@@ -1893,8 +1883,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
case 'a': {
|
|
|
1d78ed |
if (count < 7) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
qreal rx = (*num++);
|
|
|
404993 |
@@ -1916,8 +1905,7 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
case 'A': {
|
|
|
1d78ed |
if (count < 7) {
|
|
|
1d78ed |
- num += count;
|
|
|
1d78ed |
- count = 0;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
qreal rx = (*num++);
|
|
|
404993 |
@@ -1938,12 +1926,15 @@ static bool parsePathDataFast(const QStringRef &dataStr, QPainterPath &path)
|
|
|
1d78ed |
}
|
|
|
1d78ed |
break;
|
|
|
1d78ed |
default:
|
|
|
1d78ed |
- return false;
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
+ break;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
lastMode = pathElem.toLatin1();
|
|
|
1d78ed |
+ if (path.elementCount() > maxElementCount)
|
|
|
1d78ed |
+ ok = false;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
}
|
|
|
1d78ed |
- return true;
|
|
|
1d78ed |
+ return ok;
|
|
|
1d78ed |
}
|
|
|
1d78ed |
|
|
|
1d78ed |
static bool parseStyle(QSvgNode *node,
|
|
|
404993 |
@@ -2979,8 +2970,8 @@ static QSvgNode *createPathNode(QSvgNode *parent,
|
|
|
1d78ed |
|
|
|
1d78ed |
QPainterPath qpath;
|
|
|
1d78ed |
qpath.setFillRule(Qt::WindingFill);
|
|
|
1d78ed |
- //XXX do error handling
|
|
|
1d78ed |
- parsePathDataFast(data, qpath);
|
|
|
1d78ed |
+ if (!parsePathDataFast(data, qpath))
|
|
|
1d78ed |
+ qCWarning(lcSvgHandler, "Invalid path data; path truncated.");
|
|
|
1d78ed |
|
|
|
1d78ed |
QSvgNode *path = new QSvgPath(parent, qpath);
|
|
|
1d78ed |
return path;
|