[Libreoffice-commits] core.git: Branch 'libreoffice-6-1' - svgio/inc svgio/source

[Libreoffice Gerrit user]

 svgio/inc/svgnode.hxx              |    2 ++
 svgio/source/svgreader/svgnode.cxx |    7 +++++++
 2 files changed, 9 insertions(+)

New commits:
commit 741c72ebdfec5fc7e0343c050214509009a03636
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Jul 23 21:30:05 2018 +0100
Commit:     Eike Rathke <erack at redhat.com>
CommitDate: Thu Jul 26 01:13:37 2018 +0200

    crashtesting: infinite recurse with moz384637-1.svg
    
    Change-Id: Ia4bbc9d471c63812dc3ef490f32e8490bda72bfe
    Reviewed-on: https://gerrit.libreoffice.org/57889
    Tested-by: Jenkins
    Reviewed-by: Eike Rathke <erack at redhat.com>

diff --git a/svgio/inc/svgnode.hxx b/svgio/inc/svgnode.hxx
index 45d9730be909..2db5d490fa14 100644
--- a/svgio/inc/svgnode.hxx
+++ b/svgio/inc/svgnode.hxx
@@ -114,6 +114,8 @@ namespace svgio
             /// possible local CssStyle, e.g. style="fill:red; stroke:red;"
             std::unique_ptr<SvgStyleAttributes>        mpLocalCssStyle;
 
+            mutable bool                mbDecomposing;
+
             // flag if maCssStyleVector is already computed (done only once)
             bool                        mbCssStyleVectorBuilt : 1;
 
diff --git a/svgio/source/svgreader/svgnode.cxx b/svgio/source/svgreader/svgnode.cxx
index f6395a24527d..56389ef14124 100644
--- a/svgio/source/svgreader/svgnode.cxx
+++ b/svgio/source/svgreader/svgnode.cxx
@@ -267,6 +267,7 @@ namespace svgio
             maDisplay(Display_inline),
             maCssStyleVector(),
             mpLocalCssStyle(nullptr),
+            mbDecomposing(false),
             mbCssStyleVectorBuilt(false)
         {
             OSL_ENSURE(SVGTokenUnknown != maType, "SvgNode with unknown type created (!)");
@@ -464,6 +465,9 @@ namespace svgio
 
         void SvgNode::decomposeSvgNode(drawinglayer::primitive2d::Primitive2DContainer& rTarget, bool bReferenced) const
         {
+            if (mbDecomposing) //guard against infinite recurse
+                return;
+
             if(Display_none == getDisplay())
             {
                 return;
@@ -499,6 +503,8 @@ namespace svgio
 
             if(!rChildren.empty())
             {
+                mbDecomposing = true;
+
                 const sal_uInt32 nCount(rChildren.size());
 
                 for(sal_uInt32 a(0); a < nCount; a++)
@@ -571,6 +577,7 @@ namespace svgio
                         }
                     }
                 }
+                mbDecomposing = false;
             }
         }