From d1c038c22d3a28b8aea0b6e136ee3cc845c447d2 Mon Sep 17 00:00:00 2001
From: Lovell Fuller <github@lovell.info>
Date: Mon, 28 Jun 2021 14:21:40 +0100
Subject: [PATCH] svgload: skip images with invalid dimensions

---
 libvips/foreign/svgload.c       | 20 +++++++++++++-------
 test/test-suite/test_foreign.py |  4 ++++
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/libvips/foreign/svgload.c b/libvips/foreign/svgload.c
index 8b9106f9..f9fb1258 100644
--- a/libvips/foreign/svgload.c
+++ b/libvips/foreign/svgload.c
@@ -245,9 +245,11 @@ vips_foreign_load_svg_get_flags( VipsForeignLoad *load )
 	return( VIPS_FOREIGN_SEQUENTIAL );
 }
 
-static void
+static int
 vips_foreign_load_svg_parse( VipsForeignLoadSvg *svg, VipsImage *out )
 {
+	VipsObjectClass *class = VIPS_OBJECT_GET_CLASS( svg );
+
 	RsvgDimensionData dimensions;
 	int width;
 	int height;
@@ -261,6 +263,11 @@ vips_foreign_load_svg_parse( VipsForeignLoadSvg *svg, VipsImage *out )
 	width = dimensions.width;
 	height = dimensions.height;
 
+	if( width <= 0 || height <= 0 ) {
+		vips_error( class->nickname, "%s", _( "bad dimensions" ) );
+		return( -1 );
+	}
+
 	/* Calculate dimensions at required dpi/scale.
 	 */
 	scale = svg->scale * svg->dpi / 72.0;
@@ -300,6 +307,7 @@ vips_foreign_load_svg_parse( VipsForeignLoadSvg *svg, VipsImage *out )
 	 */
         vips_image_pipelinev( out, VIPS_DEMAND_STYLE_FATSTRIP, NULL );
 
+	return( 0 );
 }
 
 static int
@@ -307,9 +315,7 @@ vips_foreign_load_svg_header( VipsForeignLoad *load )
 {
 	VipsForeignLoadSvg *svg = (VipsForeignLoadSvg *) load;
 
-	vips_foreign_load_svg_parse( svg, load->out ); 
-
-	return( 0 );
+	return vips_foreign_load_svg_parse( svg, load->out );
 }
 
 static int
@@ -386,9 +392,9 @@ vips_foreign_load_svg_load( VipsForeignLoad *load )
 	 * Make tiles 2000 pixels high to limit overcomputation. 
 	 */
 	t[0] = vips_image_new(); 
-	vips_foreign_load_svg_parse( svg, t[0] ); 
-	if( vips_image_generate( t[0], 
-		NULL, vips_foreign_load_svg_generate, NULL, svg, NULL ) ||
+	if( vips_foreign_load_svg_parse( svg, t[0] ) ||
+		vips_image_generate( t[0], NULL,
+			vips_foreign_load_svg_generate, NULL, svg, NULL ) ||
 		vips_tilecache( t[0], &t[1],
 			"tile_width", VIPS_MIN( t[0]->Xsize, RSVG_MAX_WIDTH ),
 			"tile_height", 2000,
diff --git a/test/test-suite/test_foreign.py b/test/test-suite/test_foreign.py
index 0237c188..e515d765 100644
--- a/test/test-suite/test_foreign.py
+++ b/test/test-suite/test_foreign.py
@@ -895,6 +895,10 @@ class TestForeign:
         assert abs(im.width * 2 - x.width) < 2
         assert abs(im.height * 2 - x.height) < 2
 
+        with pytest.raises(pyvips.error.Error):
+            svg = b'<svg viewBox="0 0 0 0"></svg>'
+            im = pyvips.Image.new_from_buffer(svg, "")
+
     def test_csv(self):
         self.save_load("%s.csv", self.mono)