rsvg_alpha_blt() can cause array overrunning SEGV

Hi,

Also I found similar issue in rsvg_alpha_blt()
during the test for svg1.1/svg/filters-offset-01-b.
rsvg_filter_primitive_merge_render() invokes
rsvg_alpha_blt() for NULL image that srcx, srcy
are set to invalid negative values. As a result,

void
rsvg_alpha_blt (GdkPixbuf * src, gint srcx, gint srcy, gint srcwidth,
                gint srcheight, GdkPixbuf * dst, gint dstx, gint dsty)
{

...

    for (y = srcoffsety; y < srcheight; y++)
        for (x = srcoffsetx; x < srcwidth; x++) {
            guint a, c, ad, cd, ar, cr, i;

            sx = x + srcx;
            sy = y + srcy;
            dx = x + dstx;
            dy = y + dsty;
            a = src_pixels[4 * sx + sy * srcrowstride + 3];

src_pixels[] is accessed with invalid index, and
it causes SEGV by overruning index. As quick fix,
I modified rsvg_alpha_blt() to return immediately,
when pixbuf src/dst is NULL, or srcwidth/srcheight/dstx/dsty
is non-positive.

Please give me comment.

Regards,
mpsuzuki

diff --git a/rsvg-filter.c b/rsvg-filter.c
index 2a4033f..9010e12 100644
--- a/rsvg-filter.c
+++ b/rsvg-filter.c
@@ -254,6 +254,9 @@ rsvg_alpha_blt (GdkPixbuf * src, gint srcx, gint srcy, gint srcwidth,
     gint x, y, srcrowstride, dstrowstride, sx, sy, dx, dy;
     guchar *src_pixels, *dst_pixels;
 
+    if ( NULL == src || 0 >= srcwidth || 0 >= srcheight ||
+         NULL == dst || 0 >= dstx     || 0 >= dsty )
+      return;
     dstheight = srcheight;
     dstwidth = srcwidth;
 



Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb75f6720 (LWP 25371)]
rsvg_alpha_blt (src=0x0, srcx=-2147483648, srcy=-2147483648, srcwidth=0, srcheight=0, dst=0x0, dstx=-2147483648, dsty=-2147483648)
    at rsvg-filter.c:323
323                 a = src_pixels[4 * sx + sy * srcrowstride + 3];
(gdb) where
#0  rsvg_alpha_blt (src=0x0, srcx=-2147483648, srcy=-2147483648, srcwidth=0, srcheight=0, dst=0x0, dstx=-2147483648, dsty=-2147483648)
    at rsvg-filter.c:323
#1  0xb7f3f40c in rsvg_filter_primitive_merge_render (self=0x8063298, ctx=0x80988e0) at rsvg-filter.c:1647
#2  0xb7f3af88 in rsvg_filter_render (self=0x8065488, source=0x0, bg=0x0, context=0x805d530, bounds=0x805d4a0, 
    channelmap=0xb7f56dc8 "2103") at rsvg-filter.c:83
#3  0xb7f505fe in rsvg_cairo_pop_discrete_layer (ctx=0x805d530) at rsvg-cairo-draw.c:989
#4  0xb7f52909 in rsvg_cairo_render_path (ctx=0x805d530, bpath_def=0x8074548) at rsvg-cairo-draw.c:638
#5  0xb7f4cf4e in rsvg_render_path (ctx=0x805d530, 
    d=0x8090090 "M 200 50 C 200 72.091389992000003 182.09138999199999 90 160 90 C 137.90861000800001 90 120 72.091389992000003 120 50 C 120 27.908610008 137.90861000800001 10 160 10 C 182.09138999199999 10 200 27.9086"...) at rsvg-base.c:1836
#6  0xb7f439f9 in _rsvg_node_circle_draw (self=0x806bb48, ctx=0x805d530, dominate=0) at rsvg-shapes.c:566
#7  0xb7f458c4 in rsvg_node_draw (self=0x806bb48, ctx=0x805d530, dominate=0) at rsvg-structure.c:68
#8  0xb7f45d8a in _rsvg_node_draw_children (self=0x8064a10, ctx=0x805d530, dominate=0) at rsvg-structure.c:86
#9  0xb7f458c4 in rsvg_node_draw (self=0x8064a10, ctx=0x805d530, dominate=0) at rsvg-structure.c:68
#10 0xb7f45c8a in rsvg_node_svg_draw (self=0x805d828, ctx=0x805d530, dominate=0) at rsvg-structure.c:326
#11 0xb7f458c4 in rsvg_node_draw (self=0x805d828, ctx=0x805d530, dominate=0) at rsvg-structure.c:68
#12 0xb7f532b9 in rsvg_handle_render_cairo_sub (handle=0x8059c00, cr=0xb7f22020, id=0x0) at rsvg-cairo-render.c:231
#13 0xb7f5333c in rsvg_handle_render_cairo (handle=0x8059c00, cr=0xb7f22020) at rsvg-cairo-render.c:252
#14 0x08049957 in main () at rsvg-test.c:270

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference