X-Git-Url: https://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fsvgtiny.c;h=6215b04adb316b6baa971ac13d6ba5771fdc4b38;hb=35db3a3d047cd55b2104294fbe4d39f5b72a7e14;hp=413697c66e926c05159b0b33a8eaf6437d7024d1;hpb=a285e3942eb288b92a3ba77eaf564d55340b2f9d;p=libsvgtiny.git

diff --git a/src/svgtiny.c b/src/svgtiny.c
index 413697c..6215b04 100644
--- a/src/svgtiny.c
+++ b/src/svgtiny.c
@@ -402,7 +402,8 @@ svgtiny_code svgtiny_parse_path(dom_element *path,
 	dom_string *path_d_str;
 	dom_exception exc;
 	char *s, *path_d;
-	float *p;
+	float *p; /* path elemets */
+        unsigned int palloc; /* number of path elements allocated */
 	unsigned int i;
 	float last_x = 0, last_y = 0;
 	float last_cubic_x = 0, last_cubic_y = 0;
@@ -430,16 +431,31 @@ svgtiny_code svgtiny_parse_path(dom_element *path,
 		return svgtiny_SVG_ERROR;
 	}
 
-	s = path_d = strndup(dom_string_data(path_d_str),
-			     dom_string_byte_length(path_d_str));
+        /* empty path is permitted it just disables the path */
+        palloc = dom_string_byte_length(path_d_str);
+        if (palloc == 0) {
+		svgtiny_cleanup_state_local(&state);
+		return svgtiny_OK;
+        }
+
+        /* local copy of the path data allowing in-place modification */
+	s = path_d = strndup(dom_string_data(path_d_str), palloc);
 	dom_string_unref(path_d_str);
 	if (s == NULL) {
 		svgtiny_cleanup_state_local(&state);
 		return svgtiny_OUT_OF_MEMORY;
 	}
-	/* allocate space for path: it will never have more elements than d */
-	p = malloc(sizeof p[0] * strlen(s));
-	if (!p) {
+
+        /* ensure path element allocation is sensibly bounded */
+        if (palloc < 8) {
+            palloc = 8;
+        } else if (palloc > 64) {
+            palloc = palloc / 2;
+        }
+
+	/* allocate initial space for path elements */
+	p = malloc(sizeof p[0] * palloc);
+	if (p == NULL) {
 		free(path_d);
 		svgtiny_cleanup_state_local(&state);
 		return svgtiny_OUT_OF_MEMORY;
@@ -456,6 +472,21 @@ svgtiny_code svgtiny_parse_path(dom_element *path,
 		float x, y, x1, y1, x2, y2, rx, ry, rotation, large_arc, sweep;
 		int n;
 
+                /* Ensure there is sufficient space for path elements */
+                if ((palloc - i) < 7) {
+                    float *tp;
+                    palloc = (palloc * 2) + (palloc / 2);
+                    tp = realloc(p, sizeof p[0] * palloc);
+                    if (tp == NULL) {
+                        free(p);
+                        free(path_d);
+                        svgtiny_cleanup_state_local(&state);
+                        return svgtiny_OUT_OF_MEMORY;
+                    }
+                    p = tp;
+                }
+
+
 		/* moveto (M, m), lineto (L, l) (2 arguments) */
 		if (sscanf(s, " %1[MmLl] %f %f %n", command, &x, &y, &n) == 3) {
 			/*LOG(("moveto or lineto"));*/
@@ -648,6 +679,19 @@ svgtiny_code svgtiny_parse_path(dom_element *path,
 		return svgtiny_OK;
 	}
 
+        /* resize path element array to not be over allocated */
+        if (palloc != i) {
+            float *tp;
+
+            /* try the resize, if it fails just continue to use the old
+             * allocation
+             */
+            tp = realloc(p, sizeof p[0] * i);
+            if (tp != NULL) {
+                p = tp;
+            }
+        }
+
 	err = svgtiny_add_path(p, i, &state);
 
 	svgtiny_cleanup_state_local(&state);
@@ -1501,23 +1545,23 @@ void svgtiny_parse_transform(char *s, float *ma, float *mb,
 		a = d = 1;
 		b = c = 0;
 		e = f = 0;
-		if (sscanf(s, "matrix (%f %f %f %f %f %f) %n",
-					&a, &b, &c, &d, &e, &f, &n) == 6)
+		if ((sscanf(s, " matrix (%f %f %f %f %f %f ) %n",
+                            &a, &b, &c, &d, &e, &f, &n) == 6) && (n > 0))
 			;
-		else if (sscanf(s, "translate (%f %f) %n",
-					&e, &f, &n) == 2)
+		else if ((sscanf(s, " translate (%f %f ) %n",
+                                 &e, &f, &n) == 2) && (n > 0))
 			;
-		else if (sscanf(s, "translate (%f) %n",
-					&e, &n) == 1)
+		else if ((sscanf(s, " translate (%f ) %n",
+                                 &e, &n) == 1) && (n > 0))
 			;
-		else if (sscanf(s, "scale (%f %f) %n",
-					&a, &d, &n) == 2)
+		else if ((sscanf(s, " scale (%f %f ) %n",
+                                 &a, &d, &n) == 2) && (n > 0))
 			;
-		else if (sscanf(s, "scale (%f) %n",
-					&a, &n) == 1)
+		else if ((sscanf(s, " scale (%f ) %n",
+                                 &a, &n) == 1) && (n > 0))
 			d = a;
-		else if (sscanf(s, "rotate (%f %f %f) %n",
-					&angle, &x, &y, &n) == 3) {
+		else if ((sscanf(s, " rotate (%f %f %f ) %n",
+                                 &angle, &x, &y, &n) == 3) && (n > 0)) {
 			angle = angle / 180 * M_PI;
 			a = cos(angle);
 			b = sin(angle);
@@ -1525,19 +1569,19 @@ void svgtiny_parse_transform(char *s, float *ma, float *mb,
 			d = cos(angle);
 			e = -x * cos(angle) + y * sin(angle) + x;
 			f = -x * sin(angle) - y * cos(angle) + y;
-		} else if (sscanf(s, "rotate (%f) %n",
-					&angle, &n) == 1) {
+		} else if ((sscanf(s, " rotate (%f ) %n",
+                                   &angle, &n) == 1) && (n > 0)) {
 			angle = angle / 180 * M_PI;
 			a = cos(angle);
 			b = sin(angle);
 			c = -sin(angle);
 			d = cos(angle);
-		} else if (sscanf(s, "skewX (%f) %n",
-					&angle, &n) == 1) {
+		} else if ((sscanf(s, " skewX (%f ) %n",
+                                   &angle, &n) == 1) && (n > 0)) {
 			angle = angle / 180 * M_PI;
 			c = tan(angle);
-		} else if (sscanf(s, "skewY (%f) %n",
-					&angle, &n) == 1) {
+		} else if ((sscanf(s, " skewY (%f ) %n",
+                                   &angle, &n) == 1) && (n > 0)) {
 			angle = angle / 180 * M_PI;
 			b = tan(angle);
 		} else