git_clone/thorvg
1
0
Fork 0
mirror of https://github.com/thorvg/thorvg.git synced 2025-06-10 14:41:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

svg_loader: prevent heap memory overflow.

Browse source 
if the input points are odd-numberd by invalid svg data, it could access invalid memory.

Prevents it just in case.
This commit is contained in:
Hermet Park 2021-06-24 16:45:58 +09:00 • committed by Hermet Park
parent 5da4c81138
commit 86fd0f67cf
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/loaders/svg/tvgSvgSceneBuilder.cpp
View file

@ -291,7 +291,7 @@ static bool _appendShape(SvgNode* node, Shape* shape, float vx, float vy, float
case SvgNodeType::Polygon: {
if (node->node.polygon.pointsCount < 2) break;
shape->moveTo(node->node.polygon.points[0], node->node.polygon.points[1]);
for (int i = 2; i < node->node.polygon.pointsCount; i += 2) {
for (int i = 2; i < node->node.polygon.pointsCount - 1; i += 2) {
shape->lineTo(node->node.polygon.points[i], node->node.polygon.points[i + 1]);
}
shape->close();
@ -300,7 +300,7 @@ static bool _appendShape(SvgNode* node, Shape* shape, float vx, float vy, float
case SvgNodeType::Polyline: {
if (node->node.polygon.pointsCount < 2) break;
shape->moveTo(node->node.polygon.points[0], node->node.polygon.points[1]);
for (int i = 2; i < node->node.polygon.pointsCount; i += 2) {
for (int i = 2; i < node->node.polygon.pointsCount - 1; i += 2) {
shape->lineTo(node->node.polygon.points[i], node->node.polygon.points[i + 1]);
}
break;