svg: Throw on nonconforming transform attributes.

1 files changed, 39 insertions, 25 deletions

diff --git a/source/svg/svg-parse.c b/source/svg/svg-parse.c
index ac7731e1..defdeb75 100644
--- a/source/svg/svg-parse.c
+++ b/source/svg/svg-parse.c
@@ -122,25 +122,36 @@ svg_parse_transform(fz_context *ctx, svg_document *doc, char *str, fz_matrix *tr
 	int numberlen;
 	float args[6];
 	int nargs;
+	int first = 1;
 
 	nargs = 0;
 	keywordlen = 0;
 
 	while (*str)
 	{
-		keywordlen = 0;
-		nargs = 0;
+		while (svg_is_whitespace(*str))
+			str ++;
+		if (*str == 0)
+			break;
+
+		if (!first)
+		{
+			if (*str == ',')
+				str ++;
+
+			while (svg_is_whitespace(*str))
+				str ++;
+		}
+		first = 0;
 
 		/*
 		 * Parse keyword and opening parenthesis.
 		 */
 
-		while (svg_is_whitespace(*str))
-			str ++;
-
-		if (*str == 0)
-			break;
+		if (!svg_is_alpha(*str))
+			fz_throw(ctx, FZ_ERROR_GENERIC, "syntax error in transform attribute - expected keyword");
 
+		keywordlen = 0;
 		while (svg_is_alpha(*str) && keywordlen < sizeof(keyword) - 1)
 			keyword[keywordlen++] = *str++;
 		keyword[keywordlen] = 0;
@@ -155,38 +166,41 @@ svg_parse_transform(fz_context *ctx, svg_document *doc, char *str, fz_matrix *tr
 			fz_throw(ctx, FZ_ERROR_GENERIC, "syntax error in transform attribute - no open paren");
 		str ++;
 
-		while (svg_is_whitespace(*str))
-			str ++;
-
 		/*
 		 * Parse list of numbers until closing parenthesis
 		 */
 
-		while (nargs < 6)
+		nargs = 0;
+		while (*str && *str != ')' && nargs < 6)
 		{
-			numberlen = 0;
+			if (nargs > 0)
+			{
+				if (*str != ',')
+					fz_throw(ctx, FZ_ERROR_GENERIC, "syntax error in transform attribute - no comma between numbers");
+				str ++;
+			}
+
+			while (svg_is_whitespace(*str))
+				str ++;
 
+			if (!svg_is_digit(*str))
+				fz_throw(ctx, FZ_ERROR_GENERIC, "syntax error in transform attribute - number required");
+
+			numberlen = 0;
 			while (svg_is_digit(*str) && numberlen < sizeof(number) - 1)
 				number[numberlen++] = *str++;
 			number[numberlen] = 0;
-
 			args[nargs++] = fz_atof(number);
 
-			while (svg_is_whitespace_or_comma(*str))
+			while (svg_is_whitespace(*str))
 				str ++;
-
-			if (*str == ')')
-			{
-				str ++;
-				break;
-			}
-
-			if (*str == 0)
-				fz_throw(ctx, FZ_ERROR_GENERIC, "syntax error in transform attribute - no close paren");
 		}
 
-		while (svg_is_whitespace_or_comma(*str))
-			str ++;
+		if (*str == 0)
+			fz_throw(ctx, FZ_ERROR_GENERIC, "syntax error in transform attribute - no close paren");
+		if (*str != ')')
+			fz_throw(ctx, FZ_ERROR_GENERIC, "syntax error in transform attribute - expected close paren");
+		str ++;
 
 		/*
 		 * Execute the transform.