huge text node: out of memory

[Gwyn Ciesla]

In 0.48.3.1, opening or importing an .svg with a very large text area causes the open/import to fail:

bugreport.svg:2142: error: xmlSAX2Characters: huge text node: out of memory
         id="flowPara3740" /></flowRoot> <image
                                             ^
bugreport.svg:2142: parser error : Extra content at the end of the document
         id="flowPara3740" /></flowRoot> <image
                                             ^

Attaching file with which I can reproduce the bug.

See: https://bugzilla.redhat.com/show_bug.cgi?id=871012

[Alexander (alexander-redhat-bugs)]

Description of problem:
When trying to open a file that I created in inkscape on an Ubuntu system in inkscape svg format failes to open in Fedora with an out of memory error message (see below).
After removing this element with a text editor the file opens, obviously it was a large background bitmap.

Version-Release number of selected component (if applicable):
Fedora 17
inkscape.x86_64 0.48.3.1-1.fc17

How reproducible:
Try to open specific file in inkscape svg format. Example attached.

Actual results:
Window "Failed to load the requested file /home/.../asilomar.svg"
inkscape opens with empty 'New document 1'.
Command line: >>
$ inkscape asilomar.svg
asilomar.svg:2143: parser error : internal error
8AIAVESAoAYAhoGAOMoAqsXP0HuuQ+uIcMyu8HqHiHyHKHhnyHDQIwGk136hjmLlya2Kko wJUhYH33/
                                                                               ^
asilomar.svg:2143: error: xmlSAX2Characters: huge text node: out of memory
         id="flowPara3740" /></flowRoot> <image
                                             ^
asilomar.svg:2143: parser error : Extra content at the end of the document
         id="flowPara3740" /></flowRoot> <image
                                             ^
-- cut
The file shows around the specified line >>
    <flowRoot
       style="font-size:40px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;font-family:Bitstream Vera Sans"
       id="flowRoot3734"
       xml:space="preserve"><flowRegion
         id="flowRegion3736"><rect
           y="586.6864"
           x="201.74588"
           height="61.451332"
           width="67.248627"
           id="rect3738" /></flowRegion><flowPara
         id="flowPara3740" /></flowRoot> <image
       xlink:href="data:image/tiff;base64,<binarydatagoesonforever>.......
-- cut

Expected results:
File opens and is editable.

Additional info:
In current Ubuntu the file can be opened with inkscape 0.48.

[Gwyn (gwyn-redhat-bugs)]

Can you attach the file, please?

[Alexander (alexander-redhat-bugs)]

Created attachment 635043
svg files that show the described behavior

This is not the original file, but a cleaned out one.
error output is here >>
bugreport.svg:2142: error: xmlSAX2Characters: huge text node: out of memory
         id="flowPara3740" /></flowRoot> <image
                                             ^
bugreport.svg:2142: parser error : Extra content at the end of the document
         id="flowPara3740" /></flowRoot> <image
                                             ^

[Gwyn Ciesla (limburgher)]

This is on Fedora 17.

[Gwyn (gwyn-redhat-bugs)]

Filed upstream:

https://bugs.launchpad.net/inkscape/+bug/1073315

[su_v (suv-lp)]

From the original report:
> In current Ubuntu the file can be opened with inkscape 0.48.

Crash not reproduced with Inkscape 0.48.3.1 on
- Mac OS X 10.5.8 (i386), libxml2 2.7.8
- OS X 10.7.4 (x86_64), libxml2 2.7.8
- Ubuntu 12.10 (amd64, VM), libxml2 2.8.0

> bugreport.svg:2142: error: xmlSAX2Characters: huge text node: out of memory

Looks more like a problem with Fedora 17's libxml2 package, and not like an Inkscape-specific bug.

[Gwyn Ciesla (limburgher)]

Thanks, I'll dig further, as this occurs on Fedora 18 as well with libxml2 2.9.0.

[Gwyn (gwyn-redhat-bugs)]

Occurs on Fedora 18 as well, with libxml2 2.9.0.

[Daniel (daniel-redhat-bugs)]

Confirmed, basically the image

<image xlink:href="data:image/tiff;base64,SUkqAAgAAAAXAP4AB
....
TokrxM8 2U881Ziy+9XLeaZUMMYnr3OSqzN66gRKnVlLHtPnbBYDYS0kBazkppTeeKtxIwsRt/bOYyAg
AwAB oAMAAQAAAP//AAACoAQAAQAAALAJAAADoAQAAQAAALMNAAAAAAAAAAA= "
       width="2434.2515"
       height="2721.7761"
       id="image5766"
       x="35.433308"
       y="471.49432"
       style="fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:3.54330707
;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none" />

  consists of a single text node of more than 10 megabytes. The problem
is that it was one way to generate DoS attacks against services parsing
XML unchecked input, you can reproduce this with xmllint command line tool:

thinkpad:~ -> /usr/bin/xmllint --noout Desktop/Download/bugreport.svg
Desktop/Download/bugreport.svg:2142: parser error : internal error: Huge input lookup
P0HuuQ+uIcMyu8HqHiHyHKHhnyHDQIwGk136hjmLlya2Kko wJUhYH33/OAMWL+yMSbgatZl1mQmU3sI
                                                                               ^
Desktop/Download/bugreport.svg:2142: parser error : xmlSAX2Characters: huge text node
         id="flowPara3740" /></flowRoot> <image
                                             ^
Desktop/Download/bugreport.svg:2142: parser error : Extra content at the end of the document
         id="flowPara3740" /></flowRoot> <image
                                             ^
thinkpad:~ ->

  There is a parser option to disable those kind of sanity checks

thinkpad:~ -> /usr/bin/xmllint --noout --huge Desktop/Download/bugreport.svg
thinkpad:~ ->

  this could be 'fixed' in two ways:

   - reduce your image size slightly to fit in 10MB uuencoded (inkscape at
     saving time could do that kind of checking and warn the user).
   - in inkscape code where the XML is loaded add the XML_PARSE_HUGE
     option which would disable those checks. It's probably safe in
     inkscape code.

Daniel

[Daniel (daniel-redhat-bugs)]

Another option might be to switch the background image type from tiff which
is huge to an equivalent lossless format but compressed like gif or png,

Daniel

[Gwyn Ciesla (limburgher)]

See comments 5 and 6 in RH bug, some possible fixes are outlined.

[su_v (suv-lp)]

> - in inkscape code where the XML is loaded add the XML_PARSE_HUGE
> option which would disable those checks. It's probably safe in
> inkscape code.

AFAIU included in upcoming bug-fix release 0.48.4: the fix for
- Bug #297070 “depth of xmlParserMaxDepth insufficient”
 <https://bugs.launchpad.net/inkscape/+bug/297070>
does add the 'XML_PARSE_HUGE' option for reading XML from a file (though it was added to address a different parsing error which occurred on all platforms, see also comment #5), and has been backported to the stable release branch recently.

[Gwyn Ciesla (limburgher)]

Cool, when is 0.48.4 likely to come out? I could patch in the mean time if need be.

[su_v (suv-lp)]

> Cool, when is 0.48.4 likely to come out?

No date set - currently there is one blocker which is holding up the release…

> I could patch in the mean time if need be.

If you compile current stable (0.48.3.1) yourself, you could test a new build with this patch (please report back whether it helps with Fedora's current libxml2 package):

Revision 9913 / stable release branch (0.48.x):
<http://bazaar.launchpad.net/~inkscape.dev/inkscape/RELEASE_0_48_BRANCH/revision/9913>
Download diff file:
<http://bazaar.launchpad.net/~inkscape.dev/inkscape/RELEASE_0_48_BRANCH/diff/9913>

[Gwyn Ciesla (limburgher)]

Awesome, that did it. I'll carry that patch until 0.48.4. Thanks!

[Fedora (fedora-redhat-bugs)]

inkscape-0.48.3.1-2.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/inkscape-0.48.3.1-2.fc18

[Fedora (fedora-redhat-bugs)]

inkscape-0.48.3.1-2.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/inkscape-0.48.3.1-2.fc17

[Fedora (fedora-redhat-bugs)]

Package inkscape-0.48.3.1-2.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing inkscape-0.48.3.1-2.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-17442/inkscape-0.48.3.1-2.fc18
then log in and leave karma (feedback).

[Daniel (daniel-redhat-bugs)]

I just looked at inkscape-0.48.3.1-hugexml.patch and yes that looks exactly
the right fix,

  thanks for the fast reaction, let's make sure the patch is pushed
upstream (they use bazaar, which i'm not used to, so didn't checked myself)

Daniel

[Gwyn (gwyn-redhat-bugs)]

No worries, it's from upstream.

[Alexander (alexander-redhat-bugs)]

Great guys, that was fast. I can't test it at the moment, but I believe it should do it.
What a satisfying bug reporting experience! :)

[Fedora (fedora-redhat-bugs)]

inkscape-0.48.3.1-2.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.