Bug 50852 - Rendering specific SVG file at certain sizes causes a segmentation fault
Rendering specific SVG file at certain sizes causes a segmentation fault
Status: RESOLVED FIXED
Product: cairo
Classification: Unclassified
Component: general
1.12.2
x86-64 (AMD64) Linux (All)
: medium major
Assigned To: Carl Worth
cairo-bugs mailing list
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-07 11:03 UTC by Evangelos Foutras
Modified: 2012-06-08 09:27 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
SVG file causing cairo to segfault (44.55 KB, image/svg+xml)
2012-06-07 11:03 UTC, Evangelos Foutras
Details
gdb backtrace (33.00 KB, text/plain)
2012-06-07 11:04 UTC, Evangelos Foutras
Details
Premiliary test case (4.65 KB, application/octet-stream)
2012-06-07 11:45 UTC, Chris Wilson
Details
Preliminary (4.65 KB, text/plain)
2012-06-07 11:45 UTC, Chris Wilson
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Evangelos Foutras 2012-06-07 11:03:31 UTC
Created attachment 62751 [details]
SVG file causing cairo to segfault

There is a bug report [1] in Arch Linux from a user who is seeing xfce4-panel segfaults when using the Faenza icon theme and specifically the icon for the Geany application.

I have attached a modified geany.svg which is reduced to a single path. Converting it to the PNG format using rsvg results in a segmentation fault.

E.g.:

$ rsvg-convert geany.svg -o geany.png -w 40
Segmentation fault
$ rsvg-convert geany.svg -o geany.png -w 10 (this size works correctly)
$ rsvg-convert geany.svg -o geany.png -w 16
Segmentation fault

cairo is compiled with gcc 4.7; maybe this matters.

[1] https://bugs.archlinux.org/task/29751
Comment 1 Evangelos Foutras 2012-06-07 11:04:26 UTC
Created attachment 62752 [details]
gdb backtrace

I'm also attaching a gdb backtrace using a debug build of cairo. The fault occurs at cairo-tor-scan-converter.c:1361 when trying to dereference right->next which is NULL.
Comment 2 Chris Wilson 2012-06-07 11:45:00 UTC
Created attachment 62757 [details]
Premiliary test case
Comment 3 Chris Wilson 2012-06-07 11:45:30 UTC
Created attachment 62758 [details]
Preliminary
Comment 4 Chris Wilson 2012-06-08 09:27:26 UTC
commit f228769dfe5a8b5d73c49a41e95e31ed73a77fb3
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Jun 8 17:22:41 2012 +0100

    polygon-reduce: Reduce broken stopped-edge continuation
    
    This is hopefully a lesser used path and the attempted optimisation to
    continue a stopped edge with a colinear stopped edge highly unlikely and
    lost in the noise of the general inefficiency of the routine. As it was
    broken, rather than attempt to rectify the "optimisation" remove it.
    
    Reported-by: Evangelos Foutras <evangelos@foutrelis.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50852
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>