Fix SVACE issue

[platform/core/uifw/dali-toolkit.git] / dali-toolkit / third-party / nanosvg / nanosvg.cc

diff --git a/dali-toolkit/third-party/nanosvg/nanosvg.cc b/dali-toolkit/third-party/nanosvg/nanosvg.cc
old mode 100644 (file)
new mode 100755 (executable)
index 603f977..89479fd
--- a/dali-toolkit/third-party/nanosvg/nanosvg.cc
+++ b/dali-toolkit/third-party/nanosvg/nanosvg.cc
@@ -103,6 +103,14 @@ static void nsvg__parseElement(char* s,
        int end = 0;
        char quote;
 
+       /**
+        * In the original file, 's' is not compared to NULL value before it is dereferenced.
+        */
+       if (!s)
+       {
+               return;
+       }
+
        // Skip white space after the '<'
        while (*s && nsvg__isspace(*s)) s++;
 
@@ -800,7 +808,12 @@ static void nsvg__addShape(NSVGparser* p)
                return;
 
        shape = (NSVGshape*)malloc(sizeof(NSVGshape));
-       if (shape == NULL) goto error;
+
+       /**
+        * In the original file, if shape is NULL it goto error below 'return' and free shape memory.
+        * But, the error is only visited when shape is NULL, so there is not needed to free it.
+        */
+       if (shape == NULL) return;
        memset(shape, 0, sizeof(NSVGshape));
 
        memcpy(shape->id, attr->id, sizeof shape->id);
@@ -876,9 +889,6 @@ static void nsvg__addShape(NSVGparser* p)
        p->shapesTail = shape;
 
        return;
-
-error:
-       if (shape) free(shape);
 }
 
 static void nsvg__addPath(NSVGparser* p, char closed)
@@ -1082,7 +1092,7 @@ static unsigned int nsvg__parseColorHex(const char* str)
 static unsigned int nsvg__parseColorRGB(const char* str)
 {
        int r = -1, g = -1, b = -1;
-       char s1[32]="", s2[32]="";
+       char s1[33]="", s2[33]="";
        /**
         * In the original file, the formatted data reading did not specify the string with width limitation.
         * To prevent the possible overflow, we replace '%s' with '%32s' here.
@@ -1279,8 +1289,7 @@ static unsigned int nsvg__parseColor(const char* str)
 
 static float nsvg__parseOpacity(const char* str)
 {
-       float val = 0;
-       sscanf(str, "%f", &val);
+       float val = nsvg__atof(str);
        if (val < 0.0f) val = 0.0f;
        if (val > 1.0f) val = 1.0f;
        return val;
@@ -1288,8 +1297,7 @@ static float nsvg__parseOpacity(const char* str)
 
 static float nsvg__parseMiterLimit(const char* str)
 {
-       float val = 0;
-       sscanf(str, "%f", &val);
+       float val = nsvg__atof(str);
        if (val < 0.0f) val = 0.0f;
        return val;
 }
@@ -1320,13 +1328,9 @@ static int nsvg__parseUnits(const char* units)
 static NSVGcoordinate nsvg__parseCoordinateRaw(const char* str)
 {
        NSVGcoordinate coord = {0, NSVG_UNITS_USER};
-       char units[32]="";
-       /**
-        * In the original file, the formatted data reading did not specify the string with width limitation.
-        * To prevent the possible overflow, we replace '%s' with '%32s' here.
-        */
-       sscanf(str, "%f%32s", &coord.value, units);
-       coord.units = nsvg__parseUnits(units);
+       char buf[64];
+       coord.units = nsvg__parseUnits(nsvg__parseNumber(str, buf, 64));
+       coord.value = nsvg__atof(buf);
        return coord;
 }
 
@@ -2366,7 +2370,22 @@ static void nsvg__parseSVG(NSVGparser* p, const char** attr)
                        } else if (strcmp(attr[i], "height") == 0) {
                                p->image->height = nsvg__parseCoordinate(p, attr[i + 1], 0.0f, 1.0f);
                        } else if (strcmp(attr[i], "viewBox") == 0) {
-                               sscanf(attr[i + 1], "%f%*[%%, \t]%f%*[%%, \t]%f%*[%%, \t]%f", &p->viewMinx, &p->viewMiny, &p->viewWidth, &p->viewHeight);
+                               const char *s = attr[i + 1];
+                               char buf[64];
+                               s = nsvg__parseNumber(s, buf, 64);
+                               p->viewMinx = nsvg__atof(buf);
+                               while (*s && (nsvg__isspace(*s) || *s == '%' || *s == ',')) s++;
+                               if (!*s) return;
+                               s = nsvg__parseNumber(s, buf, 64);
+                               p->viewMiny = nsvg__atof(buf);
+                               while (*s && (nsvg__isspace(*s) || *s == '%' || *s == ',')) s++;
+                               if (!*s) return;
+                               s = nsvg__parseNumber(s, buf, 64);
+                               p->viewWidth = nsvg__atof(buf);
+                               while (*s && (nsvg__isspace(*s) || *s == '%' || *s == ',')) s++;
+                               if (!*s) return;
+                               s = nsvg__parseNumber(s, buf, 64);
+                               p->viewHeight = nsvg__atof(buf);
                        } else if (strcmp(attr[i], "preserveAspectRatio") == 0) {
                                if (strstr(attr[i + 1], "none") != 0) {
                                        // No uniform scaling
@@ -2782,7 +2801,10 @@ NSVGimage* nsvgParseFromFile(const char* filename, const char* units, float dpi)
 error:
        if (fp) fclose(fp);
        if (data) free(data);
-       if (image) nsvgDelete(image);
+       /**
+        * In the original file, image has null check and free it here. But because image has data after all of the 'goto error',
+        * 'free(image)' was unreachable. So, we removed it.
+        */
        return NULL;
 }