Skew caused SIGSEV in Filter::render; auto-saved file segfaults similarly when opened.

Bug #1189446 reported by Tim Rawlinson on 2013-06-10
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Inkscape
High
Alvin Penner

Bug Description

I applied a skew to a set of objects, the app crashed with:

    ** (inkscape:4489): WARNING **: 18446744072001842556 bytes requested for pixel buffer, I won't try to allocate that.
    ** (inkscape:4489): WARNING **: Memory allocation failed in Inkscape::Filters::FilterSlot::set (transform)

The file was auto-saved but causes the same crash when opened. I have attached the offending file.

Inkscape 0.48.4 r9939 on Ubuntu 13.04 x86_64 Linux 3.8.0-23-generic

The issue seems to be caused by the skew transform creating a singular matrix which then causes the Gaussian blur filter to crash. Steps to reproduce:

1. Draw a rectangle.
2. Open the Transform dialog and skew the rectangle by 60 + -30 degrees, horiz. and vert.
   respectively.
3. Open the Fill and Stroke dialog and apply a Blur, any value will do.
4. Crash.

Tim Rawlinson (tim-r) wrote :
su_v (suv-lp) wrote :

Please add information about your OS/platform and Inkscape version (see Inkscape menu 'Help > About Inkscape') to the description of the bug report (click on the small pencil icon in the upper right corner of the bug description field, and edit the original text).

tags: added: crash filters-svg transformations
Changed in inkscape:
status: New → Incomplete
Tim Rawlinson (tim-r) on 2013-06-10
description: updated
Alvin Penner (apenner) wrote :

-when I try to load this file into Windows XP, recent trunk build, I get a partially corrupted image, a lot of black rectangles, and many messages of this type:

** (inkscape.exe:4036): WARNING **: gaussian_pass_FIR: unsupported image format
** (inkscape.exe:4036): WARNING **: gaussian_pass_IIR: unsupported image format

- do you happen to have an earlier version of this file, before the crash?
- or could you provide detailed steps to reproduce?

Alvin Penner (apenner) wrote :

It appears that the problem is caused by singular transforms associated with some of the groups. A typical group is given here:

<g transform="matrix(1,0.57734758,1.7320347,1,-1213.9169,-456.09261)" id="g4140">

This transformation matrix is singular, the determinant is given by:

determinant = 1 - 0.57734758*1.7320347
                         = 0.000013957478974

Can you give some indication of how you performed the skew? I mean, did you produce it using the mouse to manually drag the edges, or did you use the Object->Transform dialog, or did you inherit these values from a different program?

The numbers in this transform were not produced by accident, since 1.732 is the square root of 2, and .577 is the reciprocal of the square root of 2, which is why the determinant is zero, and the matrix is guaranteed to cause grief.

Alvin Penner (apenner) wrote :

sorry, I meant square root of 3, and reciprocal of square root of 3, in above comments

Tim Rawlinson (tim-r) wrote :

The transform was performed using the Object->Transform dialog.

I can reproduce those values, without crashing, with a horizontal skew of 60 degrees and vertical of -30, which are the values I entered at the time as far as I can remember. The object being skewed all but disappears, as you'd expect with those values, but as I said it isn't crashing.

Tim Rawlinson (tim-r) wrote :

It seems to be caused by the Gaussian blur filter choking on the singular matrix. I have updated the description with steps to reproduce.

description: updated
Alvin Penner (apenner) wrote :

just writing to confirm that this set of skew values does indeed lead to a singular transformation matrix. This set of values should be forbidden but apparently is not forbidden. The problem with a singular matrix is that it cannot be inverted. If you attempt to invert it you get a 0/0 division problem, which is inherently ambiguous.

Changed in inkscape:
status: Incomplete → Confirmed
Alvin Penner (apenner) wrote :

fix committed to rev 12397.

before applying a transform from the Transform dialog, the matrix will be checked to see if it is singular. If it is, then it will not be applied, and instead a warning message will be flashed on the status bar at the bottom.

su_v (suv-lp) on 2013-06-29
Changed in inkscape:
assignee: nobody → Alvin Penner (apenner)
importance: Undecided → High
milestone: none → 0.49
status: Confirmed → Fix Committed
Bryce Harrington (bryce) on 2015-02-21
Changed in inkscape:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers