git_clone/thorvg
1
0
Fork 0
mirror of https://github.com/thorvg/thorvg.git synced 2025-06-08 13:43:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

lottie: Fix crash when an invalid gradient is provided

Browse source 
When lottie is broken and provides invalid gradient, the program crashes in segmentation fault.

At that time, in the `populate` function, `ColorStop& color` doesn't have `input` but tries to use it.

Added checking nullptr logic. The function `populate` will not proceed and return 0 in that case.

related issue: #2072
This commit is contained in:
Jinny You 2024-03-27 18:02:32 +09:00 • committed by Hermet Park
parent 04b5525db4
commit c8ddc316db
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/loaders/lottie/tvgLottieModel.h
View file

@ -381,6 +381,9 @@ struct LottieGradient : LottieObject
{
uint32_t populate(ColorStop& color)
{
colorStops.populated = true;
if (!color.input) return 0;
uint32_t alphaCnt = (color.input->count - (colorStops.count * 4)) / 2;
Array<Fill::ColorStop> output(colorStops.count + alphaCnt);
uint32_t cidx = 0; //color count
@ -455,7 +458,6 @@ struct LottieGradient : LottieObject
color.input->reset();
delete(color.input);
colorStops.populated = true;
return output.count;
}