Buffer overflow in svg transformation reading

[Ralf Engels]

While reviewing the svg reading code I found a problem in svg-affine.cpp

When reading the arguments of a transformation a buffer with 6 values is used but later on an unlimited amount of matrix arguments can be read.

The other buffer used in this function seems to be protected sufficiently.

The attached patch solves the problem.

[jazzynico (jazzynico)]

Apparently the args count is done later in the code, line 78:
--
if (n_args == sizeof (args) / sizeof (args[0])) return false; /* Too many args */
--

It's a bit weird, and protecting the code in the loop seems to be safer indeed.

[Martin Owens (doctormo)]

Closing because patch applied to master on GitLab.

Closed by: https://gitlab.com/doctormo