[librsvg] sax_processing_instruction_cb() - Fix crash with an empty XML processing instruction
- From: Federico Mena Quintero <federico src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [librsvg] sax_processing_instruction_cb() - Fix crash with an empty XML processing instruction
- Date: Fri, 31 May 2019 17:36:52 +0000 (UTC)
commit 2ca0108f2c6acc26b86fd19c23310937fa149ced
Author: Federico Mena Quintero <federico gnome org>
Date: Fri May 31 12:33:05 2019 -0500
sax_processing_instruction_cb() - Fix crash with an empty XML processing instruction
Thanks to Bastien Orivel for the original fuzzed file.
rsvg_internals/src/xml2_load.rs | 7 +++++--
tests/fixtures/crash/xml-pi-without-data.svg | 1 +
2 files changed, 6 insertions(+), 2 deletions(-)
---
diff --git a/rsvg_internals/src/xml2_load.rs b/rsvg_internals/src/xml2_load.rs
index d9bbb018..01b4bdcd 100644
--- a/rsvg_internals/src/xml2_load.rs
+++ b/rsvg_internals/src/xml2_load.rs
@@ -201,8 +201,11 @@ unsafe extern "C" fn sax_processing_instruction_cb(
assert!(!target.is_null());
let target = utf8_cstr(target);
- assert!(!data.is_null());
- let data = utf8_cstr(data);
+ let data = if data.is_null() {
+ ""
+ } else {
+ utf8_cstr(data)
+ };
xml.processing_instruction(target, data);
}
diff --git a/tests/fixtures/crash/xml-pi-without-data.svg b/tests/fixtures/crash/xml-pi-without-data.svg
new file mode 100644
index 00000000..d97e78c6
--- /dev/null
+++ b/tests/fixtures/crash/xml-pi-without-data.svg
@@ -0,0 +1 @@
+<?b?>
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]