Skip to content

Commit b4a7adf

Browse files
dlemstradlemstra
committed
Escape more strings when creating an MVG file in the internal SVG decoder (GHSA-xpg8-7m6m-jf56)
1 parent 61aa62c commit b4a7adf

File tree

1 file changed

+38
-42
lines changed

1 file changed

+38
-42
lines changed

‎coders/svg.c‎

Lines changed: 38 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1123,15 +1123,27 @@ static void SVGNotationDeclaration(void *context,const xmlChar *name,
11231123
name,public_id,system_id);
11241124
}
11251125

1126+
static inline char *SVGEscapeString(const char* value)
1127+
{
1128+
char
1129+
*escaped_value,
1130+
*p;
1131+
1132+
escaped_value=EscapeString(value,'\"');
1133+
for (p=escaped_value; *p != '\0'; p++)
1134+
if (*p == '\n')
1135+
*p=' ';
1136+
return(escaped_value);
1137+
}
1138+
11261139
static void SVGProcessStyleElement(void *context,const xmlChar *name,
11271140
const char *style)
11281141
{
11291142
char
11301143
background[MagickPathExtent],
11311144
*color,
11321145
*keyword,
1133-
*units,
1134-
*value;
1146+
*units;
11351147

11361148
char
11371149
**tokens;
@@ -1153,19 +1165,22 @@ static void SVGProcessStyleElement(void *context,const xmlChar *name,
11531165
for (i=0; i < ((ssize_t) number_tokens-1); i+=2)
11541166
{
11551167
keyword=(char *) tokens[i];
1156-
value=(char *) tokens[i+1];
11571168
if (LocaleCompare(keyword,"font-size") != 0)
11581169
continue;
1159-
svg_info->pointsize=GetUserSpaceCoordinateValue(svg_info,0,value);
1170+
svg_info->pointsize=GetUserSpaceCoordinateValue(svg_info,0,
1171+
(char *) tokens[i+1]);
11601172
(void) FormatLocaleFile(svg_info->file,"font-size %g\n",
11611173
svg_info->pointsize);
11621174
}
11631175
color=AcquireString("none");
11641176
units=AcquireString("userSpaceOnUse");
11651177
for (i=0; i < ((ssize_t) number_tokens-1); i+=2)
11661178
{
1179+
char
1180+
*value;
1181+
11671182
keyword=(char *) tokens[i];
1168-
value=(char *) tokens[i+1];
1183+
value=SVGEscapeString((const char *) tokens[i+1]);
11691184
(void) LogMagickEvent(CoderEvent,GetMagickModule()," %s: %s",keyword,
11701185
value);
11711186
switch (*keyword)
@@ -1448,6 +1463,7 @@ static void SVGProcessStyleElement(void *context,const xmlChar *name,
14481463
default:
14491464
break;
14501465
}
1466+
value=DestroyString(value);
14511467
}
14521468
if (units != (char *) NULL)
14531469
units=DestroyString(units);
@@ -1570,8 +1586,7 @@ static void SVGStartElement(void *context,const xmlChar *name,
15701586

15711587
const char
15721588
*keyword,
1573-
*p,
1574-
*value;
1589+
*p;
15751590

15761591
size_t
15771592
number_tokens;
@@ -1611,7 +1626,6 @@ static void SVGStartElement(void *context,const xmlChar *name,
16111626
*id='\0';
16121627
*token='\0';
16131628
*background='\0';
1614-
value=(const char *) NULL;
16151629
if ((LocaleCompare((char *) name,"image") == 0) ||
16161630
(LocaleCompare((char *) name,"pattern") == 0) ||
16171631
(LocaleCompare((char *) name,"rect") == 0) ||
@@ -1624,8 +1638,11 @@ static void SVGStartElement(void *context,const xmlChar *name,
16241638
if (attributes != (const xmlChar **) NULL)
16251639
for (i=0; (attributes[i] != (const xmlChar *) NULL); i+=2)
16261640
{
1641+
char
1642+
*value;
1643+
16271644
keyword=(const char *) attributes[i];
1628-
value=(const char *) attributes[i+1];
1645+
value=SVGEscapeString((const char *) attributes[i+1]);
16291646
switch (*keyword)
16301647
{
16311648
case 'C':
@@ -1752,6 +1769,7 @@ static void SVGStartElement(void *context,const xmlChar *name,
17521769
default:
17531770
break;
17541771
}
1772+
value=DestroyString(value);
17551773
}
17561774
if (strchr((char *) name,':') != (char *) NULL)
17571775
{
@@ -1976,8 +1994,11 @@ static void SVGStartElement(void *context,const xmlChar *name,
19761994
if (attributes != (const xmlChar **) NULL)
19771995
for (i=0; (attributes[i] != (const xmlChar *) NULL); i+=2)
19781996
{
1997+
char
1998+
*value;
1999+
19792000
keyword=(const char *) attributes[i];
1980-
value=(const char *) attributes[i+1];
2001+
value=SVGEscapeString((const char *) attributes[i+1]);
19812002
(void) LogMagickEvent(CoderEvent,GetMagickModule(),
19822003
" %s = %s",keyword,value);
19832004
switch (*keyword)
@@ -2828,6 +2849,7 @@ static void SVGStartElement(void *context,const xmlChar *name,
28282849
default:
28292850
break;
28302851
}
2852+
value=DestroyString(value);
28312853
}
28322854
if (LocaleCompare((const char *) name,"svg") == 0)
28332855
{
@@ -2928,20 +2950,9 @@ static void SVGEndElement(void *context,const xmlChar *name)
29282950
}
29292951
if (LocaleCompare((const char *) name,"desc") == 0)
29302952
{
2931-
char
2932-
*p;
2933-
29342953
if (*svg_info->text == '\0')
29352954
break;
2936-
(void) fputc('#',svg_info->file);
2937-
for (p=svg_info->text; *p != '\0'; p++)
2938-
{
2939-
(void) fputc(*p,svg_info->file);
2940-
if (*p == '\n')
2941-
(void) fputc('#',svg_info->file);
2942-
}
2943-
(void) fputc('\n',svg_info->file);
2944-
*svg_info->text='\0';
2955+
(void) FormatLocaleFile(svg_info->file,"# %s\n",svg_info->text);
29452956
break;
29462957
}
29472958
break;
@@ -2990,7 +3001,6 @@ static void SVGEndElement(void *context,const xmlChar *name)
29903001
if (LocaleCompare((const char *) name,"image") == 0)
29913002
{
29923003
char
2993-
*text,
29943004
thread_filename[MagickPathExtent];
29953005

29963006
Image
@@ -3022,12 +3032,10 @@ static void SVGEndElement(void *context,const xmlChar *name)
30223032
image=DestroyImage(image);
30233033
image_info=DestroyImageInfo(image_info);
30243034
(void) DeleteNodeFromSplayTree(svg_tree,thread_filename);
3025-
text=EscapeString(svg_info->url,'\"');
30263035
(void) FormatLocaleFile(svg_info->file,
30273036
"image Over %g,%g %g,%g \"%s\"\n",svg_info->bounds.x,
30283037
svg_info->bounds.y,svg_info->bounds.width,svg_info->bounds.height,
3029-
text);
3030-
text=DestroyString(text);
3038+
svg_info->url);
30313039
(void) FormatLocaleFile(svg_info->file,"pop graphic-context\n");
30323040
break;
30333041
}
@@ -3240,15 +3248,11 @@ static void SVGEndElement(void *context,const xmlChar *name)
32403248
{
32413249
if (LocaleCompare((char *) name,"use") == 0)
32423250
{
3243-
char
3244-
*text;
3245-
32463251
if ((svg_info->bounds.x != 0.0) || (svg_info->bounds.y != 0.0))
32473252
(void) FormatLocaleFile(svg_info->file,"translate %g,%g\n",
32483253
svg_info->bounds.x,svg_info->bounds.y);
3249-
text=EscapeString(svg_info->url,'\"');
3250-
(void) FormatLocaleFile(svg_info->file,"use \"url(%s)\"\n",text);
3251-
text=DestroyString(text);
3254+
(void) FormatLocaleFile(svg_info->file,"use \"url(%s)\"\n",
3255+
svg_info->url);
32523256
(void) FormatLocaleFile(svg_info->file,"pop graphic-context\n");
32533257
break;
32543258
}
@@ -3268,12 +3272,6 @@ static void SVGCharacters(void *context,const xmlChar *c,int length)
32683272
char
32693273
*text;
32703274

3271-
char
3272-
*p;
3273-
3274-
ssize_t
3275-
i;
3276-
32773275
SVGInfo
32783276
*svg_info;
32793277

@@ -3286,10 +3284,8 @@ static void SVGCharacters(void *context,const xmlChar *c,int length)
32863284
text=(char *) AcquireQuantumMemory(length+1,sizeof(*text));
32873285
if (text == (char *) NULL)
32883286
return;
3289-
p=text;
3290-
for (i=0; i < (ssize_t) length; i++)
3291-
*p++=c[i];
3292-
*p='\0';
3287+
memcpy(text,c,length);
3288+
text[length] = '\0';
32933289
SVGStripString(MagickFalse,text);
32943290
if (svg_info->text == (char *) NULL)
32953291
svg_info->text=text;

0 commit comments

Comments
 (0)