_rsvg_pixbuf_new_cleared() causes memset() overrun

Hi,

After my patch to use uninstalled GLib, now I'm
trying to improve librsvg configure.in to build
& check the uninstalled Pango & Gtk+.

During the checking "make check" target with latest
Gtk+ (2.18.3, cloned from git Oct-8th), I found
rsvg-test is crached with SEGV during the test for 
svg1.1/svg/filters-displace-01-f.

I attached the gdb stack trace in the end of this
post. I think the scenario is following:

1) rsvg_filter_render() is called with null source image,
   and construct a context for new filter.

2) when a context is constructed from a null image,
   gdk_pixbuf_get_width() & gdk_pixbuf_get_height()
   are called to set the size information of the image.

3) gdk_pixbuf_get_width() & gdk_pixbuf_get_height()
   return negative value, to indicate invalid source
   image is passed.

4) rsvg_filter_render() does not care negative value,
   and invoke _rsvg_pixbuf_new_cleared().

5) _rsvg_pixbuf_new_cleared() invokes memset().
   Both of width & height are negative, so multiplied
   "size" of the pixbuf is positive, so memset() tries
   to clear the buffer with a finite length. But
   the buffer is originally zero-sized, so overrunning
   memset() causes a SEGV.

I'm not sure if invalid sizes should cause some error
immediately, so, I inserted a small check to prevent
overrunning memset(), like this:

diff --git a/rsvg-filter.c b/rsvg-filter.c
index 705f14c..2a4033f 100644
--- a/rsvg-filter.c
+++ b/rsvg-filter.c
@@ -158,7 +158,8 @@ _rsvg_pixbuf_new_cleared (GdkColorspace colorspace, gboolean has_alpha, int bits
 
     pb = gdk_pixbuf_new (colorspace, has_alpha, bits_per_sample, width, height);
     data = gdk_pixbuf_get_pixels (pb);
-    memset (data, 0, width * height * 4);
+    if ( width > 0 && height > 0 )
+      memset (data, 0, width * height * 4);
 
     return pb;
 }


Please give me comment.

Regards,
mpsuzuki

P.S.

Following is the stacktrace that rsvg-test is crashed
by the latest Gtk+ and svg1.1/svg/filters-displace-01-f.

(process:19449): GdkPixbuf-CRITICAL **: gdk_pixbuf_new_from_data: assertion `data != NULL' failed

(process:19449): GdkPixbuf-CRITICAL **: gdk_pixbuf_new_from_data: assertion `data != NULL' failed

(process:19449): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed

(process:19449): GdkPixbuf-CRITICAL **: gdk_pixbuf_get_width: assertion `GDK_IS_PIXBUF (pixbuf)' failed

(process:19449): GdkPixbuf-CRITICAL **: gdk_pixbuf_get_height: assertion `GDK_IS_PIXBUF (pixbuf)' failed

(process:19449): GdkPixbuf-CRITICAL **: gdk_pixbuf_new: assertion `width > 0' failed

(process:19449): GdkPixbuf-CRITICAL **: gdk_pixbuf_get_pixels: assertion `GDK_IS_PIXBUF (pixbuf)' failed
[New Thread 0xb766b720 (LWP 19449)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb766b720 (LWP 19449)]
0xb7821f47 in memset () from /lib/i686/cmov/libc.so.6
(gdb) where
#0  0xb7821f47 in memset () from /lib/i686/cmov/libc.so.6
#1  0xb7fb06f6 in _rsvg_pixbuf_new_cleared (colorspace=GDK_COLORSPACE_RGB, has_alpha=1, bits_per_sample=8, width=-1, height=-1)
    at rsvg-filter.c:161
#2  0xb7fb0793 in rsvg_filter_primitive_image_render (self=0x8063a60, ctx=0x80576d8) at rsvg-filter.c:3425
#3  0xb7faff88 in rsvg_filter_render (self=0x8063510, source=0x0, bg=0x0, context=0x805a3a8, bounds=0x805a318, 
    channelmap=0xb7fcbdc8 "2103") at rsvg-filter.c:83
#4  0xb7fc55ee in rsvg_cairo_pop_discrete_layer (ctx=0x805a3a8) at rsvg-cairo-draw.c:989
#5  0xb7fc78f9 in rsvg_cairo_render_path (ctx=0x805a3a8, bpath_def=0x8052d50) at rsvg-cairo-draw.c:638
#6  0xb7fc1f3e in rsvg_render_path (ctx=0x805a3a8, 
    d=0x80571a0 "M 15 15 H 143 A0 0 0 0 1 143 15 V 143 A0 0 0 0 1 143 143 H 15 A0 0 0 0 1 15 143 V 15 A0 0 0 0 1 15 15 Z")
    at rsvg-base.c:1836
#7  0xb7fb972a in _rsvg_node_rect_draw (self=0x8069b80, ctx=0x805a3a8, dominate=0) at rsvg-shapes.c:441
#8  0xb7fba8b4 in rsvg_node_draw (self=0x8069b80, ctx=0x805a3a8, dominate=0) at rsvg-structure.c:68
#9  0xb7fbad7a in _rsvg_node_draw_children (self=0x80649e8, ctx=0x805a3a8, dominate=0) at rsvg-structure.c:86
#10 0xb7fba8b4 in rsvg_node_draw (self=0x80649e8, ctx=0x805a3a8, dominate=0) at rsvg-structure.c:68
#11 0xb7fbad7a in _rsvg_node_draw_children (self=0x8062488, ctx=0x805a3a8, dominate=0) at rsvg-structure.c:86
#12 0xb7fba8b4 in rsvg_node_draw (self=0x8062488, ctx=0x805a3a8, dominate=0) at rsvg-structure.c:68
#13 0xb7fbac7a in rsvg_node_svg_draw (self=0x805a508, ctx=0x805a3a8, dominate=0) at rsvg-structure.c:326
#14 0xb7fba8b4 in rsvg_node_draw (self=0x805a508, ctx=0x805a3a8, dominate=0) at rsvg-structure.c:68
#15 0xb7fc82a9 in rsvg_handle_render_cairo_sub (handle=0x8056800, cr=0xb7f97020, id=0x0) at rsvg-cairo-render.c:231
#16 0xb7fc832c in rsvg_handle_render_cairo (handle=0x8056800, cr=0xb7f97020) at rsvg-cairo-render.c:252
#17 0x08049957 in main () at rsvg-test.c:270

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference