Subject: bug#36773: 27.0.50; Accessing a cached SVG with eww can cause Emacs to crash

From: Adam Plaice <[email-masked]>
Date: Thu, 25 Jul 2019 00:13:16 +0200

> I'm attaching a patch to fix the rsvg segfault, and another patch
> which works around the url-http issue. However, I'm not sure how the
> latter should be fixed properly.

Thanks! The first patch indeed prevents the crash, while the second also
causes the image to be displayed (as expected).

> -      (zlib-decompress-region (point) (point-max)))))))
> +      (zlib-decompress-region (point) (point-max) t))))))

> So I guess that is a hint, we could just go back to the Emacs-26
> behavior. I don't think we should, but in practice it should work
> okay.

b36913d803ee22a314f2e0a27523fbadeb60dd2c introduced the above change.
Testing with a checkout of it, results in a blank "standard error box"
being displayed, though interestingly without a crash.  At
b36913d803ee22a314f^ the SVG was correctly displayed, so
b36913d803ee22a314f did indeed introduce (part of) this bug.  However,
not using ALLOW-PARTIAL, would re-introduce Bug#33133, which would
probably not be a great idea.

(I tried bisecting to find out when the crashes themselves started,
but without appropriate "make clean"ing (or more severe), I ended up
in an unbuildable state, and I didn't have time for full rebuilds,
with this range to be bisected.  In any case, your
0001-Don-t-crash-when-parsing-bad-SVG-data-bug-36773.patch fixes the
crash.)

> I thought that additional argument only mattered upon failure to
> completely uncompress the data.  Otherwise, the use of that argument
> should not have changed the behavior.  Are you saying that the
> decompression failed in this case?  If not, what am I missing?

If I understand the issue correctly, it's because
`zlib-decompress-region' is trying to decompress content that is in
the cache and had already been decompressed.  Hence, the decompression
fails and deletes the contents, which, depending on other particulars,
either crashes Emacs or causes a warning, and in any case prevents the
actual image from being displayed.

Thank you!
Adam