ports/55076: memory access after free() in librsvg2

[Alexander Nedotsukov]

>Number:         55076
>Category:       ports
>Synopsis:       memory access after free() in librsvg2
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jul 30 10:50:06 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator:     Alexander Nedotsukov
>Release:        FreeBSD 5.1-CURRENT i386
>Organization:
>Environment:
System: FreeBSD bbnest.dyndns.org 5.1-CURRENT FreeBSD 5.1-CURRENT #2: Tue Jul 29 21:17:03 JST 2003 bland at bbnest.dyndns.org:/usr/obj/usr/src/sys/SU i386


	
>Description:
librsvg2 2.2.x versions contains s/w bug wich access memory already been freed
to walk through the handlers stack. On system with J malloc option enabled this
lead to crash inside rsvg parser.
This bug affects GNOME users have a deal with .svg files badly.
	
>How-To-Repeat:
Assume librsvg2 and gnome-themes-extra iports installed.
$rsvg /usr/X11R6/share/icons/Lush/scalable/emblems/emblem-mail.svg crash.png
	
>Fix:
Apply patch attached
	

--- patch-rsvg.c begins here ---
--- rsvg.c.orig	Thu Jul 31 02:03:34 2003
+++ rsvg.c	Thu Jul 31 02:26:35 2003
@@ -332,13 +332,14 @@
 {
 	RsvgSaxHandlerGstops *z = (RsvgSaxHandlerGstops *)self;
 	RsvgHandle *ctx = z->ctx;
+	RsvgSaxHandler *prev = &z->parent->super;
 	
 	if (!strcmp((char *)name, z->parent_tag))
 		{
 			if (ctx->handler != NULL)
 				{
 					ctx->handler->free (ctx->handler);
-					ctx->handler = &z->parent->super;
+					ctx->handler = prev;
 				}
 		}
 }
@@ -679,13 +680,14 @@
 {
 	RsvgSaxHandlerStyle *z = (RsvgSaxHandlerStyle *)self;
 	RsvgHandle *ctx = z->ctx;
+	RsvgSaxHandler *prev = &z->parent->super;
 	
 	if (!strcmp ((char *)name, "style"))
 		{
 			if (ctx->handler != NULL)
 				{
 					ctx->handler->free (ctx->handler);
-					ctx->handler = &z->parent->super;
+					ctx->handler = prev;
 				}
 		}
 }
--- patch-rsvg.c ends here ---


>Release-Note:
>Audit-Trail:
>Unformatted: