Merge branch 'fuzz-use-cycles' into 'main'

#1092 - Fix stack overflow in <use> reference cycle

Closes #1092

See merge request GNOME/librsvg!988

Author: Marge Bot

rsvg/src/api.rs

@@ -84,6 +84,9 @@ impl From<InternalRenderingError> for RenderingError {
             InternalRenderingError::InvalidTransform => {
                 RenderingError::Rendering("invalid transform".to_string())
             }
+            InternalRenderingError::CircularReference(c) => {
+                RenderingError::Rendering(format!("circular reference in node {c}"))
+            }
             InternalRenderingError::IdNotFound => RenderingError::IdNotFound,
             InternalRenderingError::InvalidId(s) => RenderingError::InvalidId(s),
             InternalRenderingError::OutOfMemory(s) => RenderingError::OutOfMemory(s),

rsvg/src/document.rs

@@ -766,6 +766,7 @@ pub struct AcquiredNodes<'i> {
     document: &'i Document,
     num_elements_acquired: usize,
     node_stack: Rc<RefCell<NodeStack>>,
+    nodes_with_cycles: Vec<Node>,
 }
 
 impl<'i> AcquiredNodes<'i> {
@@ -774,6 +775,7 @@ impl<'i> AcquiredNodes<'i> {
             document,
             num_elements_acquired: 0,
             node_stack: Rc::new(RefCell::new(NodeStack::new())),
+            nodes_with_cycles: Vec::new(),
         }
     }
 
@@ -810,6 +812,10 @@ impl<'i> AcquiredNodes<'i> {
             .lookup_node(node_id)
             .ok_or_else(|| AcquireError::LinkNotFound(node_id.clone()))?;
 
+        if self.nodes_with_cycles.contains(&node) {
+            return Err(AcquireError::CircularReference(node.clone()));
+        }
+
         if node.borrow_element().is_accessed_by_reference() {
             self.acquire_ref(&node)
         } else {
@@ -829,8 +835,11 @@ impl<'i> AcquiredNodes<'i> {
     /// * At the drawing stage, `acquire_ref()` the pattern node that we already had, so that
     /// its child elements that reference other paint servers will be able to detect circular
     /// references to the pattern.
-    pub fn acquire_ref(&self, node: &Node) -> Result<AcquiredNode, AcquireError> {
-        if self.node_stack.borrow().contains(node) {
+    pub fn acquire_ref(&mut self, node: &Node) -> Result<AcquiredNode, AcquireError> {
+        if self.nodes_with_cycles.contains(node) {
+            Err(AcquireError::CircularReference(node.clone()))
+        } else if self.node_stack.borrow().contains(node) {
+            self.nodes_with_cycles.push(node.clone());
             Err(AcquireError::CircularReference(node.clone()))
         } else {
             self.node_stack.borrow_mut().push(node);

rsvg/src/drawing_ctx.rs

@@ -1753,9 +1753,9 @@ impl DrawingCtx {
         let _self_acquired = match acquired_nodes.acquire_ref(node) {
             Ok(n) => n,
 
-            Err(AcquireError::CircularReference(_)) => {
-                rsvg_log!(self.session, "circular reference in element {}", node);
-                return Ok(self.empty_bbox());
+            Err(AcquireError::CircularReference(circular)) => {
+                rsvg_log!(self.session, "circular reference in element {}", circular);
+                return Err(InternalRenderingError::CircularReference(circular));
             }
 
             _ => unreachable!(),
@@ -1764,9 +1764,14 @@ impl DrawingCtx {
         let acquired = match acquired_nodes.acquire(link) {
             Ok(acquired) => acquired,
 
-            Err(AcquireError::CircularReference(node)) => {
-                rsvg_log!(self.session, "circular reference in element {}", node);
-                return Ok(self.empty_bbox());
+            Err(AcquireError::CircularReference(circular)) => {
+                rsvg_log!(
+                    self.session,
+                    "circular reference from {} to element {}",
+                    node,
+                    circular
+                );
+                return Err(InternalRenderingError::CircularReference(circular));
             }
 
             Err(AcquireError::MaxReferencesExceeded) => {

rsvg/src/error.rs

@@ -121,7 +121,7 @@ impl fmt::Display for DefsLookupErrorKind {
 ///   "If a transform function causes the current transformation matrix of an
 ///   object to be non-invertible, the object and its content do not get
 ///   displayed."
-#[derive(Debug, Clone)]
+#[derive(Clone)]
 pub enum InternalRenderingError {
     /// An error from the rendering backend.
     Rendering(String),
@@ -135,6 +135,8 @@ pub enum InternalRenderingError {
     /// the problematic element.
     InvalidTransform,
 
+    CircularReference(Node),
+
     /// Tried to reference an SVG element that does not exist.
     IdNotFound,
 
@@ -169,6 +171,9 @@ impl fmt::Display for InternalRenderingError {
             InternalRenderingError::Rendering(ref s) => write!(f, "rendering error: {s}"),
             InternalRenderingError::LimitExceeded(ref l) => write!(f, "{l}"),
             InternalRenderingError::InvalidTransform => write!(f, "invalid transform"),
+            InternalRenderingError::CircularReference(ref c) => {
+                write!(f, "circular reference in element {c}")
+            }
             InternalRenderingError::IdNotFound => write!(f, "element id not found"),
             InternalRenderingError::InvalidId(ref s) => write!(f, "invalid id: {s:?}"),
             InternalRenderingError::OutOfMemory(ref s) => write!(f, "out of memory: {s}"),

rsvg/src/filters/error.rs

@@ -3,7 +3,7 @@ use std::fmt;
 use crate::error::InternalRenderingError;
 
 /// An enumeration of errors that can occur during filter primitive rendering.
-#[derive(Debug, Clone)]
+#[derive(Clone)]
 pub enum FilterError {
     /// The filter was passed invalid input (the `in` attribute).
     InvalidInput,

rsvg/src/node.rs

@@ -348,6 +348,14 @@ impl NodeDraw for Node {
                     // displayed."
                     Err(InternalRenderingError::InvalidTransform) => Ok(draw_ctx.empty_bbox()),
 
+                    Err(InternalRenderingError::CircularReference(node)) => {
+                        if node != *self {
+                            return Ok(draw_ctx.empty_bbox());
+                        } else {
+                            return Err(InternalRenderingError::CircularReference(node));
+                        }
+                    }
+
                     Err(e) => Err(e),
                 };