mattrajca/SVGKit — Issue #14: Major parser bug - buffer overflow in SVGPathElement
Author: adamgit
Created: 2011-11-21 17:53:41+00:00
State: open

Line 134: "accum[accumIdx++] = c;"

There is NOTHING to stop accumIdx from going way over the bounds of the array.

The array is only 16 characters long, and it's easy to find SVG files that will cause that to overflow :(.

Expect app crashes and other horrors ... (I found this because the overflow overwrote the string-length mem location, and eventualy the app wrote to unavailable mem and crashed with EXC_BAD_ACCESS)