Bug 700301 - infinite loop in function svg_dev_end_tile in source/fitz/svg-device.c
infinite loop in function svg_dev_end_tile in source/fitz/svg-device.c
Status: UNCONFIRMED
Product: MuPDF
Classification: Unclassified
Component: svg output
master
PC Linux
: P4 normal
Assigned To: Robin Watts
Bug traffic
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-11-30 03:08 UTC by kuaicar87
Modified: 2018-12-05 16:29 UTC (History)
1 user (show)

See Also:
Customer:
Word Size: ---


Attachments
the POC to trigger the bug (1.21 KB, application/pdf)
2018-11-30 03:08 UTC, kuaicar87
Details

Note You need to log in before you can comment on or make changes to this bug.
Description kuaicar87 2018-11-30 03:08:49 UTC
Created attachment 16426 [details]
the POC to trigger the bug

When I tried to convert a pdf file to svg file, there is an infite loop in svg_dev_end_tile in source/fitz/svg-device.c. 

```
static void
svg_dev_end_tile(fz_context *ctx, fz_device *dev)
{
......

for (x = 0; x > -w; x -= t->step.x)
		for (y = 0; y > -h; y -= t->step.y)
			fz_write_printf(ctx, out, "<use x=\"%g\" y=\"%g\" xlink:href=\"#pac%d\"/>\n", x, y, t->pattern);

}
gef➤  p t.step
$11 = {
  x = 0, 
  y = 0
}
```
because the values of t->step.x and t->step.y always are zero, so the program can be stuck in infinite loop state.
Comment 1 kuaicar87 2018-11-30 03:10:23 UTC
This bug is reported by fish@360TeamSeri0us, please send email to teamSeri0us360@gmail.com if you have some quetions.