linebender / linebender/resvg

Panic `assertion failed: edges[curr_idx].last_y >= curr_y as i32` in `tiny-skia-0.11.4/src/scan/path.rs`

Open
#933 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
4.1k
Forks
348
Avg merge
1d 14h
Merged PRs (30d)
3

Description

File content(at the bottom should be attached raw, not formatted file - github removes some non-printable characters, so copying from here may not work):

<svg height="32" viewBox="0 0 8.4.9" width="32" x="w"><g m=""><g><path d="m3 6h8v-158758583"/></g></g></svg>

command

timeout -v 100 resvg TEST___FILE.svg

cause this

thread 'main' panicked at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tiny-skia-0.11.4/src/scan/path.rs:221:13:
assertion failed: edges[curr_idx].last_y >= curr_y as i32
stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/e4662966273ed58b51f9ff8d682accc202aa1210/library/std/src/panicking.rs:697:5
   1: core::panicking::panic_fmt
             at /rustc/e4662966273ed58b51f9ff8d682accc202aa1210/library/core/src/panicking.rs:75:14
   2: core::panicking::panic
             at /rustc/e4662966273ed58b51f9ff8d682accc202aa1210/library/core/src/panicking.rs:145:5
   3: tiny_skia::scan::path::walk_edges
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tiny-skia-0.11.4/src/scan/path.rs:221:13
   4: tiny_skia::scan::path::fill_path_impl
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tiny-skia-0.11.4/src/scan/path.rs:188:5
   5: tiny_skia::scan::path_aa::fill_path_impl
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tiny-skia-0.11.4/src/scan/path_aa.rs:120:5
   6: tiny_skia::scan::path_aa::fill_path
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tiny-skia-0.11.4/src/scan/path_aa.rs:73:5
   7: tiny_skia::painter::<impl tiny_skia::pixmap::PixmapMut>::fill_path
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tiny-skia-0.11.4/src/painter.rs:293:21
   8: tiny_skia::painter::<impl tiny_skia::pixmap::PixmapMut>::fill_path
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tiny-skia-0.11.4/src/painter.rs:310:18
   9: resvg::path::fill_path
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/path.rs:73:12
  10: resvg::path::render
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/path.rs:18:9
  11: resvg::render::render_node
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/render.rs:32:13
  12: resvg::render::render_nodes
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/render.rs:17:9
  13: resvg::render::render_group
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/render.rs:58:9
  14: resvg::render::render_node
  15: resvg::render::render_nodes
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/render.rs:17:9
  16: resvg::render::render_group
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/render.rs:58:9
  17: resvg::render::render_node
  18: resvg::render::render_nodes
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/render.rs:17:9
  19: resvg::render::render_group
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/render.rs:58:9
  20: resvg::render::render_node
  21: resvg::render::render_nodes
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/render.rs:17:9
  22: resvg::render
             at /home/runner/.cargo/git/checkouts/resvg-2970f6cc9c85afc6/ded4b13/crates/resvg/src/lib.rs:49:5
  23: resvg::check_file
             at ./src/crates/resvg/src/main.rs:40:9
  24: resvg::main
             at ./src/crates/resvg/src/main.rs:21:9
  25: core::ops::function::FnOnce::call_once
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:253:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

##### Automatic Fuzzer note, output status "None", output signal "Some(6)"

compressed.zip

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the panic with the attached SVG using timeout -v 100 resvg TEST___FILE.svg. Start at tiny-skia-0.11.4/src/scan/path.rs:221, then follow the stack through walk_edges, fill_path_impl, and resvg's crates/resvg/src/path.rs. Done means this input no longer causes the assertion panic.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
computer-graphics
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.