gentoo-overlay/gnome-base/librsvg/files/librsvg-2.40.13-filters-crash.patch

From d937c691678803ceda6be701587d997ccd03a1da Mon Sep 17 00:00:00 2001
From: Benjamin Otte <otte@redhat.com>
Date: Fri, 29 Jan 2016 12:49:55 +0100
Subject: Don't crash when filters don't exist

We put a new surface on the stack if a filter existed by name but we
didn't pop it if the name didn't resolve to a real filter.

New test: crash/bug759084.svg

https://bugzilla.gnome.org/show_bug.cgi?id=759084
---
 rsvg-cairo-draw.c                  | 6 +++---
 tests/fixtures/crash/bug759084.svg | 9 +++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)
 create mode 100644 tests/fixtures/crash/bug759084.svg

diff --git a/rsvg-cairo-draw.c b/rsvg-cairo-draw.c
index 4d8fbc2..4152cb7 100644
--- a/rsvg-cairo-draw.c
+++ b/rsvg-cairo-draw.c
@@ -819,10 +819,10 @@ rsvg_cairo_pop_render_stack (RsvgDrawingCtx * ctx)
         cairo_surface_t *output;
 
         filter = rsvg_acquire_node (ctx, state->filter);
-        if (filter && RSVG_NODE_TYPE (filter) == RSVG_NODE_TYPE_FILTER) {
-            output = render->surfaces_stack->data;
-            render->surfaces_stack = g_list_delete_link (render->surfaces_stack, render->surfaces_stack);
+        output = render->surfaces_stack->data;
+        render->surfaces_stack = g_list_delete_link (render->surfaces_stack, render->surfaces_stack);
 
+        if (filter && RSVG_NODE_TYPE (filter) == RSVG_NODE_TYPE_FILTER) {
             needs_destroy = TRUE;
             surface = rsvg_filter_render ((RsvgFilter *) filter, output, ctx, &render->bbox, "2103");
             /* Don't destroy the output surface, it's owned by child_cr */
diff --git a/tests/fixtures/crash/bug759084.svg b/tests/fixtures/crash/bug759084.svg
new file mode 100644
index 0000000..9e8f8f1
--- /dev/null
+++ b/tests/fixtures/crash/bug759084.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10">
+  <defs>
+    <filter id="filter">
+    </filter>
+  </defs>
+  <g filter="url(#filter)">
+    <rect fill="red" width="10" height="10" filter="url(#doesnotexist)" />
+  </g>
+</svg>
-- 
cgit v0.12