From aac28c250c262e344522f0156ff0d58bdd040c10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Trond=20Kjern=C3=A5sen?= <trond@trolltech.com>
Date: Mon, 8 Jun 2009 16:27:19 +0200
Subject: Fixed a validation problem in QSvgIOHandler::canRead().

QSvgIOHandler::canRead() only looked at the 80 first bytes in a SVG
file when looking for the <svg> tag. That tag can obviously be found
at an arbitrary offset from the start of the file, depending on
e.g. comments tags.

Task-number: 255419
Reviewed-by: Kim
---
 src/plugins/imageformats/svg/qsvgiohandler.cpp | 35 ++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/src/plugins/imageformats/svg/qsvgiohandler.cpp b/src/plugins/imageformats/svg/qsvgiohandler.cpp
index 41b247b..405a760 100644
--- a/src/plugins/imageformats/svg/qsvgiohandler.cpp
+++ b/src/plugins/imageformats/svg/qsvgiohandler.cpp
@@ -64,6 +64,7 @@ public:
     }
 
     bool load(QIODevice *device);
+    static bool findSvgTag(QIODevice *device);
 
     QSvgRenderer *r;
     QSize         defaultSize;
@@ -86,6 +87,33 @@ bool QSvgIOHandlerPrivate::load(QIODevice *device)
     return loaded;
 }
 
+bool QSvgIOHandlerPrivate::findSvgTag(QIODevice *device)
+{
+    qint64 pos = device->pos();
+    device->seek(0);
+    char buffer[256];
+    const char svg_tag[] = "<svg";
+
+    while (1) {
+        int size = device->read(buffer, 256);
+        for (int i=0; i<size - 5; ++i) {
+            if (!memcmp(buffer + i, svg_tag, 4)) {
+                if (buffer[i+4] == ' ' || buffer[i+4] == '\t'
+                    || buffer[i+4] == '\n' || buffer[i+4] == '\r')
+                {
+                    device->seek(pos);
+                    return true;
+                }
+            }
+        }
+        if (device->atEnd())
+            break;
+        device->seek(device->pos()-4);
+    }
+    device->seek(pos);
+    return false;
+}
+
 QSvgIOHandler::QSvgIOHandler()
     : d(new QSvgIOHandlerPrivate())
 {
@@ -101,9 +129,7 @@ QSvgIOHandler::~QSvgIOHandler()
 
 bool QSvgIOHandler::canRead() const
 {
-    QByteArray contents = device()->peek(80);
-
-    return contents.contains("<svg");
+    return QSvgIOHandlerPrivate::findSvgTag(device());
 }
 
 
@@ -182,8 +208,7 @@ bool QSvgIOHandler::supportsOption(ImageOption option) const
 
 bool QSvgIOHandler::canRead(QIODevice *device)
 {
-    QByteArray contents = device->peek(80);
-    return contents.contains("<svg");
+    return QSvgIOHandlerPrivate::findSvgTag(device);
 }
 
 QT_END_NAMESPACE
-- 
cgit v0.12