|
| 1 | +From 17878e6b10471dd28af590d9733ee9b996e86258 Mon Sep 17 00:00:00 2001 |
| 2 | +From: AllSpark < [email protected]> |
| 3 | +Date: Tue, 14 Oct 2025 09:58:40 +0000 |
| 4 | +Subject: [PATCH] Replace check for endless recursion when loading |
| 5 | + |
| 6 | +The old check parsed the tree of SvgNodes again and again which lead to |
| 7 | +quadratic complexity. Instead, set and check a bool where the recursion |
| 8 | +may actually happen which is faster and only has linear complexity. |
| 9 | + |
| 10 | +Partially reverts 0332df304f013ded362537c1f61556098b875352 |
| 11 | + |
| 12 | +I chose to have the check in QSvgPattern::renderPattern() because: |
| 13 | + |
| 14 | +- It not only appears in the recursive backtrace of the stack-overflow |
| 15 | + which was fixed using the qudratic check, but also in the backtrace |
| 16 | + of another, still unfixed stack overflow. That way, both can be fixed |
| 17 | + by the same patch. Credit to OSS-Fuzz for finding them. |
| 18 | +- The function already had some error checking and returns a default |
| 19 | + value when it cannot render the content. In the same way, I can return |
| 20 | + a QImage of the right size but without any content when the endless |
| 21 | + recursion is about to happen. |
| 22 | + |
| 23 | +[ChangeLog] Speed up loading by replacing check for cyclic elements |
| 24 | +[ChangeLog] Fix stack overflow when an element references its child |
| 25 | +element using url() |
| 26 | + |
| 27 | +Fixes: QTBUG-137553 |
| 28 | +Pick-to: 6.8 |
| 29 | +Change-Id: If011c15fde50dcefeb653d1d5995ff1347e7b5ac |
| 30 | +Reviewed-by: Hatem ElKharashy < [email protected]> |
| 31 | +(cherry picked from commit 9e5bed9584ab65d56cd5fbac0471e06e37a54412) |
| 32 | +Reviewed-by: Qt Cherry-pick Bot < [email protected]> |
| 33 | +(cherry picked from commit 90a5331640bb760b0114a7ea4e08b9e42b03e082) |
| 34 | +Signed-off-by: Azure Linux Security Servicing Account < [email protected]> |
| 35 | +Upstream-reference: AI Backport of https://github.com/qt/qtsvg/commit/ea44b50c6e61104cadd6b7c8ede92a4108634232.patch |
| 36 | +--- |
| 37 | + src/svg/qsvghandler.cpp | 3 +++ |
| 38 | + 1 file changed, 3 insertions(+) |
| 39 | + |
| 40 | +diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp |
| 41 | +index 335500a..fb0f131 100644 |
| 42 | +--- a/src/svg/qsvghandler.cpp |
| 43 | ++++ b/src/svg/qsvghandler.cpp |
| 44 | +@@ -3663,6 +3663,9 @@ void QSvgHandler::parse() |
| 45 | + // namespaceUri is empty. The only possible strategy at |
| 46 | + // this point is to do what everyone else seems to do and |
| 47 | + // ignore the reported namespaceUri completely. |
| 48 | ++ // NOTE: Previously, a quadratic cycle-detection check was performed here. |
| 49 | ++ // It has been removed to improve performance; cycle detection now occurs |
| 50 | ++ // after parsing and resolution, which is linear overall. |
| 51 | + if (remainingUnfinishedElements |
| 52 | + && startElement(xml->name().toString(), xml->attributes())) { |
| 53 | + --remainingUnfinishedElements; |
| 54 | +-- |
| 55 | +2.45.4 |
| 56 | + |
0 commit comments