From 520d6e7bbdbc74c94aa25ff31d5a7493b4eeeb8f Mon Sep 17 00:00:00 2001 From: Michal Maciola Date: Fri, 25 Jun 2021 17:36:00 +0200 Subject: [PATCH] svg_loader: negative attrs length fix After finding no attributes but white spaces, attrs length could be negative that resulted in segmentation fault in simpleXmlParseAttributes function. @Issue: #487 --- src/loaders/svg/tvgSvgLoader.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/loaders/svg/tvgSvgLoader.cpp b/src/loaders/svg/tvgSvgLoader.cpp index f2515549..a6402d48 100644 --- a/src/loaders/svg/tvgSvgLoader.cpp +++ b/src/loaders/svg/tvgSvgLoader.cpp @@ -2174,11 +2174,11 @@ static void _svgLoaderParserXmlOpen(SvgLoaderData* loader, const char* content, if (attrs) { //Find out the tag name starting from content till sz length sz = attrs - content; - attrsLength = length - sz; while ((sz > 0) && (isspace(content[sz - 1]))) sz--; if ((unsigned)sz >= sizeof(tagName)) return; strncpy(tagName, content, sz); tagName[sz] = '\0'; + attrsLength = length - sz; } if ((method = _findGroupFactory(tagName))) { @@ -2540,11 +2540,11 @@ static bool _svgLoaderParserForValidCheckXmlOpen(SvgLoaderData* loader, const ch if (attrs) { sz = attrs - content; - attrsLength = length - sz; while ((sz > 0) && (isspace(content[sz - 1]))) sz--; if ((unsigned)sz >= sizeof(tagName)) return false; strncpy(tagName, content, sz); tagName[sz] = '\0'; + attrsLength = length - sz; } if ((method = _findGroupFactory(tagName))) {