Skip to content
Commit 34c95743 authored by Christian Persch's avatar Christian Persch
Browse files

Store node type separately in RsvgNode

The node name (formerly RsvgNode:type) cannot be used to infer
the sub-type of RsvgNode that we're dealing with, since for unknown
elements we put type = node-name. This lead to a (potentially exploitable)
crash e.g. when the element name started with "fe" which tricked
the old code into considering it as a RsvgFilterPrimitive.

CVE-2011-3146

https://bugzilla.gnome.org/show_bug.cgi?id=658014
parent eaaa3212
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment