From 489324f3920c8a0d6d36d8787a359d5a56d0a076 Mon Sep 17 00:00:00 2001
From: Lovell Fuller <github@lovell.info>
Date: Fri, 21 Aug 2020 10:11:11 +0100
Subject: [PATCH] Ensure SVG loader skips input with chars outside x09-x7F
 range

Add test with example valid WebP image that happens to contain
the string '<svg' within its compressed image data.
---
 libvips/foreign/svgload.c                  |   4 ++--
 test/test-suite/helpers/helpers.py         |   1 +
 test/test-suite/images/looks-like-svg.webp | Bin 0 -> 2608 bytes
 test/test-suite/test_foreign.py            |   7 ++++++-
 4 files changed, 9 insertions(+), 3 deletions(-)
 create mode 100644 test/test-suite/images/looks-like-svg.webp

diff --git a/libvips/foreign/svgload.c b/libvips/foreign/svgload.c
index 212c76a7..d8d06a38 100644
--- a/libvips/foreign/svgload.c
+++ b/libvips/foreign/svgload.c
@@ -211,7 +211,7 @@ vips_foreign_load_svg_is_a( const void *buf, size_t len )
 	 * before the <svg line.
 	 *
 	 * Simple rules:
-	 * - first 24 chars are plain ascii
+	 * - first 24 chars are plain ascii (x09-x7F)
 	 * - first SVG_HEADER_SIZE chars contain "<svg", upper or lower case.
 	 *
 	 * We could rsvg_handle_new_from_data() on the buffer, but that can be
@@ -220,7 +220,7 @@ vips_foreign_load_svg_is_a( const void *buf, size_t len )
 	if( len < 24 )
 		return( 0 );
 	for( i = 0; i < 24; i++ )
-		if( !isascii( str[i] ) )
+		if( !isascii( str[i] ) || str[i] < 9 )
 			return( FALSE );
 	for( i = 0; i < SVG_HEADER_SIZE && i < len - 5; i++ )
 		if( g_ascii_strncasecmp( str + i, "<svg", 4 ) == 0 )
diff --git a/test/test-suite/helpers/helpers.py b/test/test-suite/helpers/helpers.py
index e5645713..8d1c309d 100644
--- a/test/test-suite/helpers/helpers.py
+++ b/test/test-suite/helpers/helpers.py
@@ -21,6 +21,7 @@ OME_FILE = os.path.join(IMAGES, "multi-channel-z-series.ome.tif")
 ANALYZE_FILE = os.path.join(IMAGES, "t00740_tr1_segm.hdr")
 GIF_FILE = os.path.join(IMAGES, "cramps.gif")
 WEBP_FILE = os.path.join(IMAGES, "1.webp")
+WEBP_LOOKS_LIKE_SVG_FILE = os.path.join(IMAGES, "looks-like-svg.webp")
 EXR_FILE = os.path.join(IMAGES, "sample.exr")
 FITS_FILE = os.path.join(IMAGES, "WFPC2u5780205r_c0fx.fits")
 OPENSLIDE_FILE = os.path.join(IMAGES, "CMU-1-Small-Region.svs")
diff --git a/test/test-suite/images/looks-like-svg.webp b/test/test-suite/images/looks-like-svg.webp
new file mode 100644
index 0000000000000000000000000000000000000000..f5056005d8583b37ecd0d6aa11fa09ca3c560a03
GIT binary patch
literal 2608
zcmV-03eWXYNk&E}3IG6CMM6+kP&il$0000G000300093006|PpNGJdR009p${}B-a
zZQHiVma}qN9xuSz2eggo{{+<g>6sA7VPep+{r<Z%09H^qAleB40B}J7odGHU0RRC$
zZ8n!lBqE|DA=H_;fDMUhZsBu4^E*keo$>ANV^Hp846>Qz`~rUXB>>;q02})t1Ak-y
zZ|r~#{g45_vH&;sKnDKE0N>cVui7aLXSPDb#(O;gKauGMrhN*O0J=J>`ycp&z~b_^
z-JdC5K*}<w4#*;96l3lBelm_a2i;=~WFewf!FE|2`ycr=fMLCr+~G{IX^p4ub+{dX
zqT15uB%e?xVY7pX+6_~<jufN@{-~((r9~>Rj3WQ;9llY&NI&1F&c7|~E6=EJV-M}6
zw2Oz9+;s)@YL>s5#T0<CmNS($|B#@S;BzNUV@&%z11Kj^LKLFJKz(SXnaQ&;F*3b;
z?6RerOM`f}GDD%|rwJ2iEL1PWF0ddYye(CSW+cL;+<iX?jxg7vavS%p!fb}W2?)$T
zRrs7)iFR+;%(AM#C9HA;eW$P|Q1K%RY2RXriDXavNz~=!bMqK=M^O?`sdvJcHeO2c
zAkGr)sTxhHPsUGxdA;F8_;$0?^XkU!j4&Y-D9$@9r~FvH?7nP$wNRGECT}yD&yhc3
z8|!HLx44oPno`Bja=DyQND5`XP|EC3vNJn%>42NhJ2XKr480W}s-|RYWZ$vpriPe2
zmQ`2v1FATBWOMxS`@#OZR@c2eb9QI(Mn7bl6<1hv{-1z(4jF%`tHRKO5rU?BrWG#U
z0092~m7)Lu00011M|60VWd|7HCg!6i6Cg?oXEJ$jV_%YN9K2ccN0R*{rdnZ{S}d_G
z+HVuHavj_hL2t+q5voVBNcqq$yXbbuO)Y|mTw8S7wsi&`!ud(FLx`LOq#D!Lr+yVv
zgLL-*&SSNY74DD;d!6@GZsCd7(R!sg!{ex5d%4HS^(xbeoCOs1a+Y1b8PV)waG?;z
z4SRGG+}S=_@hGrsJn3-a?#uefA=XBoqziGmR!|?Hj?BS`UoD(KKZzl4CiTxw!Q1+K
z0BzO)ZmB@Xl~LvXtIE>_v>ss#q2Ft?!{PQL$Mnx|m;<moN2;E&YUkY1M2LiY5UU_>
zo#g^vB(Ri7^#Qve5=e1{>_?ST$y5Q?`0^*^=eKZyeFP248p++pL~wqMHPKIlrWk`o
zQ|GHMQe^xP9L06I(^SK~y1_MJIQKmgCsvdr%Qu}Oc4KxH{F<#t^2P-E$`G2C(;mMb
z2CSP;p&rEHhz`JtWO0^?{OAQU>apEUqw5|r?hs2Hk?O4#lveDfW}v&q07-9N{#?zr
zqy?G@z%pyq0E;7{C-H0&v6z#>#W53(uZTQNdh{;TkY`JTW&>?a(ge(DTT^X`S~^$h
zb!i(&?-z?N5l?L__Xo=hQw}%+lf9|-Dsm}0Aq)6$^>E|`cB!0jXjlV<R9BW)oEu%#
z0~<k5!mlb8QJux?D%asmZZi|Vdez!5NunaxrT;-&FnZR>NEmNpl~~Z&$|mA+8R;ZR
zI~<!6(6|%+hdSu^uA|>R{=E$i!AR@_O7FZA;Nt-lY>i9+QKihfSG$V&4|j-iznoo6
zxqxdh<-w{bKaJ>OsC*+FmHW6)v|x$OO>rLnas-cwwQHoJZA4p%t$0M7u@}0M5jH;X
z?fEp^TN;N5IcaXxi?ObyW~P^esJUg^f&%S)O{<oh%~4cMkpIt^i0Z+6TZ{|FH=Ng{
zG{UNIM2<<v81d1&kUG7V*5TwiiQtk0ok~BjFok$%m1ApFuR<v7<yaWuDAe`VNOEvo
z&AqBF<lPThs<k<wlMtJXm{)TdWIU)wURPQE#J6)cAJ8k*;6h>-`vaGI1}==p`@rPG
zU`<k*Qit6F4yg}X3f&QcuK^1i*N3FO<LvhSO?OHpEVH$6oT@vR0dG%Tw#7nRD7-Ff
z+eZ%V5FS9zOREXE${TH~nuZM5n&s2Iip|xC++!T10wQHdqeXeR&dICd7t%ns&yNT$
z+D?u(nXbL2S~Nh$TNE$X9iCNv-$wan?~23k*R2S1Cg6Ue58sW05+J4qb6&bl>Px67
za@huJc(}vMX3a@cOdrb@L~~B^9{(LLIF$-4dX|jTbes3h-wSu#?=D5myL0ZWu+N(q
zCQH0@tvnSzu#&~qsxOm4WGf^a0^22LW|}hs6Yn`kp#;9#4OupN0Bg;{wX<u+EO*Pw
zX#2&&XOc8O0MSAr$X&|DO4`pV*Mk!w-b5#CE;gd`sYpX%@1L(c73((A+0cB(=!F)j
z@^0Mh=&XO2+(rFZUC$E2xUw%lVSGUP6-;%2pEyOWW6;{Otod0#Ro`ApD%cbd<?g)&
zcPJ6BQdT+31Xo@eh7{a7_BZouku^Q9t#&K7igPQ)!QS$wHH1Z~M#<qJ|Df$-5C+)T
zJxlzDx(lI4gM+HdUg<UI9%Ke1$4|4H#j^Hht7s&><x)d^LFgyLWo1sh&F11mzUD@F
zI6^WEJdR&#TG(|kbj~QH6!9>ml6%87=ouv`F9K|B6SxF)frBZd=6Z}?FOGJjs?9XR
zSd5ho`Zvbc5csKdft_}hwmh}&t5Rr+-rh$txr$&$a?=QJ1&+|(*i%^ZnCbtuS|+OS
zhO~9rxRG>)ECb#f&ZGdUdiupR>!TVSO__$2eAB|~BN*6O<1)lFYTqNM8F>}WbapyB
zau1aE@lK0@7pN50YeBiL7HWRPj5q1InWkhlWu}^GC>V*k_)3z<;OMUwRz(UIwxm<)
zR<O3AvaH~N*VqKpe8l#^I6@V0D8*pnfVMzFBKJX6Y7%F7E{v)5=Ej)7(0;J#xO=;;
zA1?hN^4^?V+r1GJ88Hfyh!`;Dlmr1Pnn>p-DF-YC#Y|hy<8k8HL}LgUa~<e{uCGrI
zKyc`R27Qfv#cl-cE1gP?oSku<N)ZxZ*DU=Bf&UNQy_)J>`Mve)N??<)&$G=MTxMV|
zV7?t}{g)#*e*cjT99}lERHEMBU)lgA>oAwLoIbb|+b#-62lM~QyD1GeQr}T)@z(y>
z($|q!`#Hv17(c&Xb=#taqip^WwH%)3axTfM;3F6AUJ4XjIcBecD}iyOZ8rU?x;sFB
zf44;~pstG=t<*(4<im0J;4Pb5hHr4CXgy~AZN>wuUhkS;I9Ifr*?#kr<Pw!_KCG)x
z`rsWEDoR{?<8cob^qTTiV(-#G{qv<B-=$l5WU$HcQOfm8p~T~3D=)M*^%A5t&DvUC
z@vK@VLimlId)w-`Tcxqj?xyQ)l4C4ip5?aMZ1Wq!uqCfrKv}JPu@`4RYP6z_CY@iB
z)f{<h)E+(sO`Z;(Lu=b}$1i0ENBl*v%^B9C96{q!GXap~m3&SXR$<S#U?Dx&Ng7FA
SRPN|`b7!5?;42=4fB*nTUjaP;

literal 0
HcmV?d00001

diff --git a/test/test-suite/test_foreign.py b/test/test-suite/test_foreign.py
index 182f8af8..9f3386ab 100644
--- a/test/test-suite/test_foreign.py
+++ b/test/test-suite/test_foreign.py
@@ -17,7 +17,7 @@ from helpers import \
     GIF_ANIM_DISPOSE_PREVIOUS_FILE, \
     GIF_ANIM_DISPOSE_PREVIOUS_EXPECTED_PNG_FILE, \
     temp_filename, assert_almost_equal_objects, have, skip_if_no, \
-    TIF1_FILE, TIF2_FILE, TIF4_FILE
+    TIF1_FILE, TIF2_FILE, TIF4_FILE, WEBP_LOOKS_LIKE_SVG_FILE
 
 
 class TestForeign:
@@ -676,6 +676,11 @@ class TestForeign:
             assert x1.get("page-height") == x2.get("page-height")
             assert x1.get("gif-loop") == x2.get("gif-loop")
 
+        # WebP image that happens to contain the string "<svg"
+        if have("svgload"):
+            x = pyvips.Image.new_from_file(WEBP_LOOKS_LIKE_SVG_FILE)
+            assert x.get("vips-loader") == "webpload"
+
     @skip_if_no("analyzeload")
     def test_analyzeload(self):
         def analyze_valid(im):