From: Paul Eggert <eggert@cs.ucla.edu>
Date: Thu, 25 Jul 2019 21:29:22 +0000 (-0700)
Subject: Don't crash when parsing bad SVG data
X-Git-Tag: emacs-27.0.90~1817^2~120
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=263b9680f3204be994a90f3f2b73adaa81bec8dd;p=emacs.git

Don't crash when parsing bad SVG data

Derived from a patch by Pip Cet (Bug#36773#47).
* src/image.c (svg_load_image): Work around librsvg 2.40.13 bug.
---

diff --git a/src/image.c b/src/image.c
index 355c849491a..8cab860085f 100644
--- a/src/image.c
+++ b/src/image.c
@@ -9530,10 +9530,13 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
   if (base_file)
     g_object_unref (base_file);
   g_object_unref (input_stream);
-  if (err) goto rsvg_error;
+
+  /* Check rsvg_handle too, to avoid librsvg 2.40.13 bug (Bug#36773#26).  */
+  if (!rsvg_handle || err) goto rsvg_error;
 #else
   /* Make a handle to a new rsvg object.  */
   rsvg_handle = rsvg_handle_new ();
+  eassume (rsvg_handle);
 
   /* Set base_uri for properly handling referenced images (via 'href').
      See rsvg bug 596114 - "image refs are relative to curdir, not .svg file"
@@ -9654,7 +9657,8 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
   return 1;
 
  rsvg_error:
-  g_object_unref (rsvg_handle);
+  if (rsvg_handle)
+    g_object_unref (rsvg_handle);
   /* FIXME: Use error->message so the user knows what is the actual
      problem with the image.  */
   image_error ("Error parsing SVG image `%s'", img->spec);