From 3167c1374bb918033b5b4a5b54e0d0608698eeb0 Mon Sep 17 00:00:00 2001
From: Joerg Bornemann <joerg.bornemann@digia.com>
Date: Wed, 1 Oct 2014 18:55:15 +0200
Subject: fix crash on malformed SVG

In a gradient that references itself via xlink:href we encountered
an infinite recursion, and eventually a stack overflow.
Now we print a warning and ignore the invalid link.

Task-number: QTBUG-35387
Change-Id: Id72800eaa267d015a471df284245861ed8bc94cd
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@digia.com>
---
 tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'tests')

diff --git a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
index 2aa2225..8487d54 100644
--- a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
+++ b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
@@ -620,6 +620,15 @@ void tst_QSvgRenderer::gradientRefs()
                 "<linearGradient id=\"gradient\" xlink:href=\"#gradient0\">"
                 "</linearGradient>"
             "</defs>"
+        "</svg>",
+        "<svg>"
+            "<defs>"
+                "<linearGradient xlink:href=\"#0\" id=\"0\">"
+                    "<stop offset=\"0\" stop-color=\"red\" stop-opacity=\"0\"/>"
+                    "<stop offset=\"1\" stop-color=\"blue\"/>"
+                "</linearGradient>"
+            "</defs>"
+            "<rect fill=\"url(#0)\" height=\"8\" width=\"256\" x=\"0\" y=\"0\"/>"
         "</svg>"
     };
     for (size_t i = 0 ; i < sizeof(svgs) / sizeof(svgs[0]) ; ++i)
-- 
cgit v1.2.1