From 20bb79886de5b7e24b6796aaa9811153abda86c9 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 23 Jul 2018 21:30:05 +0100
Subject: crashtesting: infinite recurse with moz384637-1.svg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Ia4bbc9d471c63812dc3ef490f32e8490bda72bfe
Reviewed-on: https://gerrit.libreoffice.org/57888
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 svgio/inc/svgnode.hxx              | 2 ++
 svgio/source/svgreader/svgnode.cxx | 7 +++++++
 2 files changed, 9 insertions(+)

(limited to 'svgio')

diff --git a/svgio/inc/svgnode.hxx b/svgio/inc/svgnode.hxx
index 45d9730be909..2db5d490fa14 100644
--- a/svgio/inc/svgnode.hxx
+++ b/svgio/inc/svgnode.hxx
@@ -114,6 +114,8 @@ namespace svgio
             /// possible local CssStyle, e.g. style="fill:red; stroke:red;"
             std::unique_ptr<SvgStyleAttributes>        mpLocalCssStyle;
 
+            mutable bool                mbDecomposing;
+
             // flag if maCssStyleVector is already computed (done only once)
             bool                        mbCssStyleVectorBuilt : 1;
 
diff --git a/svgio/source/svgreader/svgnode.cxx b/svgio/source/svgreader/svgnode.cxx
index f6395a24527d..56389ef14124 100644
--- a/svgio/source/svgreader/svgnode.cxx
+++ b/svgio/source/svgreader/svgnode.cxx
@@ -267,6 +267,7 @@ namespace svgio
             maDisplay(Display_inline),
             maCssStyleVector(),
             mpLocalCssStyle(nullptr),
+            mbDecomposing(false),
             mbCssStyleVectorBuilt(false)
         {
             OSL_ENSURE(SVGTokenUnknown != maType, "SvgNode with unknown type created (!)");
@@ -464,6 +465,9 @@ namespace svgio
 
         void SvgNode::decomposeSvgNode(drawinglayer::primitive2d::Primitive2DContainer& rTarget, bool bReferenced) const
         {
+            if (mbDecomposing) //guard against infinite recurse
+                return;
+
             if(Display_none == getDisplay())
             {
                 return;
@@ -499,6 +503,8 @@ namespace svgio
 
             if(!rChildren.empty())
             {
+                mbDecomposing = true;
+
                 const sal_uInt32 nCount(rChildren.size());
 
                 for(sal_uInt32 a(0); a < nCount; a++)
@@ -571,6 +577,7 @@ namespace svgio
                         }
                     }
                 }
+                mbDecomposing = false;
             }
         }
 
-- 
cgit