Bug 50852 - Rendering specific SVG file at certain sizes causes a segmentation fault
Rendering specific SVG file at certain sizes causes a segmentation fault
Product: cairo
Classification: Unclassified
Component: general
x86-64 (AMD64) Linux (All)
: medium major
Assigned To: Carl Worth
cairo-bugs mailing list
Depends on:
  Show dependency treegraph
Reported: 2012-06-07 11:03 UTC by Evangelos Foutras
Modified: 2012-06-08 09:27 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:

SVG file causing cairo to segfault (44.55 KB, image/svg+xml)
2012-06-07 11:03 UTC, Evangelos Foutras
gdb backtrace (33.00 KB, text/plain)
2012-06-07 11:04 UTC, Evangelos Foutras
Premiliary test case (4.65 KB, application/octet-stream)
2012-06-07 11:45 UTC, Chris Wilson
Preliminary (4.65 KB, text/plain)
2012-06-07 11:45 UTC, Chris Wilson

Note You need to log in before you can comment on or make changes to this bug.
Description Evangelos Foutras 2012-06-07 11:03:31 UTC
Created attachment 62751 [details]
SVG file causing cairo to segfault

There is a bug report [1] in Arch Linux from a user who is seeing xfce4-panel segfaults when using the Faenza icon theme and specifically the icon for the Geany application.

I have attached a modified geany.svg which is reduced to a single path. Converting it to the PNG format using rsvg results in a segmentation fault.


$ rsvg-convert geany.svg -o geany.png -w 40
Segmentation fault
$ rsvg-convert geany.svg -o geany.png -w 10 (this size works correctly)
$ rsvg-convert geany.svg -o geany.png -w 16
Segmentation fault

cairo is compiled with gcc 4.7; maybe this matters.

[1] https://bugs.archlinux.org/task/29751
Comment 1 Evangelos Foutras 2012-06-07 11:04:26 UTC
Created attachment 62752 [details]
gdb backtrace

I'm also attaching a gdb backtrace using a debug build of cairo. The fault occurs at cairo-tor-scan-converter.c:1361 when trying to dereference right->next which is NULL.
Comment 2 Chris Wilson 2012-06-07 11:45:00 UTC
Created attachment 62757 [details]
Premiliary test case
Comment 3 Chris Wilson 2012-06-07 11:45:30 UTC
Created attachment 62758 [details]
Comment 4 Chris Wilson 2012-06-08 09:27:26 UTC
commit f228769dfe5a8b5d73c49a41e95e31ed73a77fb3
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Jun 8 17:22:41 2012 +0100

    polygon-reduce: Reduce broken stopped-edge continuation
    This is hopefully a lesser used path and the attempted optimisation to
    continue a stopped edge with a colinear stopped edge highly unlikely and
    lost in the noise of the general inefficiency of the routine. As it was
    broken, rather than attempt to rectify the "optimisation" remove it.
    Reported-by: Evangelos Foutras <evangelos@foutrelis.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50852
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>