git_clone/thorvg
1
0
Fork 0
mirror of https://github.com/thorvg/thorvg.git synced 2025-07-24 23:28:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

loaders svg: ++safety

Browse source 
prevent buffer overflow just in case.
This commit is contained in:
Hermet Park 2021-04-20 17:43:16 +09:00 • committed by Hermet Park
parent 332012dd6b
commit b541a0654c
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/loaders/svg/tvgSvgLoader.cpp
View file

@ -504,13 +504,13 @@ static void _toColor(const char* str, uint8_t* r, uint8_t* g, uint8_t* b, string
} }
static char* _parseNumbersArray(char* str, float* points, int* ptCount) static char* _parseNumbersArray(char* str, float* points, int* ptCount, int len)
{ {
int count = 0; int count = 0;
char* end = nullptr; char* end = nullptr;
str = _skipSpace(str, nullptr); str = _skipSpace(str, nullptr);
while (isdigit(*str) || *str == '-' || *str == '+' || *str == '.') { while ((count < len) && (isdigit(*str) || *str == '-' || *str == '+' || *str == '.')) {
points[count++] = strtof(str, &end); points[count++] = strtof(str, &end);
str = end; str = end;
str = _skipSpace(str, nullptr); str = _skipSpace(str, nullptr);
@ -586,11 +586,13 @@ static void _matrixCompose(const Matrix* m1, const Matrix* m2, Matrix* dst)
*/ */
static Matrix* _parseTransformationMatrix(const char* value) static Matrix* _parseTransformationMatrix(const char* value)
{ {
const int POINT_CNT = 8;
auto matrix = (Matrix*)malloc(sizeof(Matrix)); auto matrix = (Matrix*)malloc(sizeof(Matrix));
if (!matrix) return nullptr; if (!matrix) return nullptr;
*matrix = {1, 0, 0, 0, 1, 0, 0, 0, 1}; *matrix = {1, 0, 0, 0, 1, 0, 0, 0, 1};
float points[8]; float points[POINT_CNT];
int ptCount = 0; int ptCount = 0;
char* str = (char*)value; char* str = (char*)value;
char* end = str + strlen(str); char* end = str + strlen(str);
@ -614,7 +616,7 @@ static Matrix* _parseTransformationMatrix(const char* value)
str = _skipSpace(str, end); str = _skipSpace(str, end);
if (*str != '(') goto error; if (*str != '(') goto error;
++str; ++str;
str = _parseNumbersArray(str, points, &ptCount); str = _parseNumbersArray(str, points, &ptCount, POINT_CNT);
if (*str != ')') goto error; if (*str != ')') goto error;
++str; ++str;