bug#36773: 27.0.50; Accessing a cached SVG with eww can cause Emacs to crash

[Pip Cet <pipcet@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 862 bytes --]

On Tue, Jul 23, 2019 at 9:14 PM Adam Plaice <plaiceadam@gmail.com> wrote:
>
> I've attached the backtrace.

Thanks. This seems like a librsvg bug, since it returned a NULL handle
but no error.

As for the other bug, it's a little tricky: shr calls
url-store-in-cache after url-http-parse-headers has decompressed the
file, while url-http-parse-headers itself would (correctly) cache the
uncompressed file if it were configured to do so. It's not quite clear
who's at fault here.

IOW, there's probably a conflict in existing cache directories: some
of them will store the compressed data, which won't work if it's
images; some will store the uncompressed data, which won't work for
HTML data.

I'm attaching a patch to fix the rsvg segfault, and another patch
which works around the url-http issue. However, I'm not sure how the
latter should be fixed properly.

[-- Attachment #2: 0002-Cache-HTTP-responses-as-uncompressed-data.patch --]
[-- Type: text/x-patch, Size: 2275 bytes --]

From 4206c1f7a833a54e13dab318abd332a4fb35d067 Mon Sep 17 00:00:00 2001
From: Pip Cet <pipcet@gmail.com>
Date: Wed, 24 Jul 2019 13:23:50 +0000
Subject: [PATCH 2/2] Cache HTTP responses as uncompressed data.

* lisp/url/url-http.el (url-http-parse-headers): Decompress before
storing URL buffers in the cache.
---
 lisp/url/url-http.el | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/lisp/url/url-http.el b/lisp/url/url-http.el
index 527760118d..d282b166e9 100644
--- a/lisp/url/url-http.el
+++ b/lisp/url/url-http.el
@@ -589,6 +589,7 @@ url-http-parse-headers
   (let* ((buffer (current-buffer))
          (class (/ url-http-response-status 100))
          (success nil)
+         (nodecompress nil)
          ;; other status symbols: jewelry and luxury cars
          (status-symbol (cadr (assq url-http-response-status url-http-codes))))
     (url-http-debug "Parsed HTTP headers: class=%d status=%d"
@@ -628,8 +629,10 @@ url-http-parse-headers
 	  ;; Generic success for all others.  Store in the cache, and
 	  ;; mark it as successful.
 	  (widen)
-	  (if (and url-automatic-caching (equal url-http-method "GET"))
-	      (url-store-in-cache buffer))))
+	  (when (and url-automatic-caching (equal url-http-method "GET"))
+            (setq nodecompress t)
+            (url-handle-content-transfer-encoding)
+	    (url-store-in-cache buffer))))
        (setq success t))
       (3				; Redirection
        ;; 300 Multiple choices
@@ -677,7 +680,8 @@ url-http-parse-headers
 			    (url-cache-create-filename (url-view-url t)))
 	    (url-cache-extract (url-cache-create-filename (url-view-url t)))
 	    (setq redirect-uri nil
-		  success t))
+		  success t
+                  nodecompress t))
 	   ('use-proxy			; 305
 	    ;; The requested resource MUST be accessed through the
 	    ;; proxy given by the Location field.  The Location field
@@ -941,7 +945,8 @@ url-http-parse-headers
 	      class url-http-response-status)))
     (if (not success)
 	(url-mark-buffer-as-dead buffer)
-      (url-handle-content-transfer-encoding))
+      (if (not nodecompress)
+          (url-handle-content-transfer-encoding)))
     (url-http-debug "Finished parsing HTTP headers: %S" success)
     (widen)
     (goto-char (point-min))
-- 
2.22.0


[-- Attachment #3: 0001-Don-t-crash-when-parsing-bad-SVG-data-bug-36773.patch --]
[-- Type: text/x-patch, Size: 1503 bytes --]

From 1b6f3bd532bf1ea819d3780def2e2c9594b1204d Mon Sep 17 00:00:00 2001
From: Pip Cet <pipcet@gmail.com>
Date: Wed, 24 Jul 2019 12:34:36 +0000
Subject: [PATCH 1/2] Don't crash when parsing bad SVG data (bug#36773)

* src/image.c (svg_load_image): Be more careful about librsvg
returning NULL pointers.
---
 src/image.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/image.c b/src/image.c
index 355c849491..b1f84e1946 100644
--- a/src/image.c
+++ b/src/image.c
@@ -9530,11 +9530,15 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
   if (base_file)
     g_object_unref (base_file);
   g_object_unref (input_stream);
-  if (err) goto rsvg_error;
+  if (err || rsvg_handle == NULL)
+    goto rsvg_error;
 #else
   /* Make a handle to a new rsvg object.  */
   rsvg_handle = rsvg_handle_new ();
 
+  if (rsvg_handle == NULL)
+    goto rsvg_error;
+
   /* Set base_uri for properly handling referenced images (via 'href').
      See rsvg bug 596114 - "image refs are relative to curdir, not .svg file"
      <https://gitlab.gnome.org/GNOME/librsvg/issues/33>. */
@@ -9654,7 +9658,8 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
   return 1;
 
  rsvg_error:
-  g_object_unref (rsvg_handle);
+  if (rsvg_handle != NULL)
+    g_object_unref (rsvg_handle);
   /* FIXME: Use error->message so the user knows what is the actual
      problem with the image.  */
   image_error ("Error parsing SVG image `%s'", img->spec);
-- 
2.22.0