transform matrix with very high numbers crashes inkscape
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Inkscape |
Invalid
|
High
|
Unassigned |
Bug Description
An svg containing the following transform matrix crashes inkscape on nearly every interaction (try drag select f. ex.)
transform=
The numbers are extremely high, I know. But this is a line inkscape produced itself. I just clicked too long on the arrow to enlarge the object. As there have been lots of effects on the object, scaling went slowly and I stopped too late. Inkscape crashed eventually as well.
However, I think there should be some kind of bounds-checking before the memcpy() crashes inkscape upon trying to apply the insane transformation matrix!
The attached file is stripped of all the other content, but I think it should still be complete syntax-wise.
Inkscape 0.48 64bit on stable Gentoo.
tags: |
added: transformations removed: large matrix sigsegv transform |
Changed in inkscape: | |
importance: | Undecided → High |
Changed in inkscape: | |
status: | New → Incomplete |
tags: | added: filters-svg |
Crash not reproduced with Inkscape 0.48.1 on Mac OS X 10.5.8 (i386), but Inkscape is unable to display the scaled object (group) on-canvas even when zoomed out to the max (1.0%). Removing the filter effects does prevent the console messages, but the object appears to be simply too large for Inkscape's support of canvas size.
repeated console messages (AFAIU from the filter effects inside the 'matrix' -transformed group(s)):
WARNING **: 203190120 bytes requested for pixel buffer, I won't try to allocate that.