Bug#740784: librsvg2-bin: Wrong "flag" parsing in path descriptions

[Samuel Bronson]

Package: librsvg2-bin
Version: 2.40.0-1
Severity: normal

Dear Maintainer,

Consider the two SVGs encosed, and the diff between them.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: path-flag-misparsed.svg
URL: <http://lists.alioth.debian.org/pipermail/pkg-gnome-maintainers/attachments/20140304/efbb148d/attachment.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: path-flag-intended.svg
URL: <http://lists.alioth.debian.org/pipermail/pkg-gnome-maintainers/attachments/20140304/efbb148d/attachment-0001.ksh>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: path-flag.diff
Type: text/x-diff
Size: 480 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-gnome-maintainers/attachments/20140304/efbb148d/attachment.diff>
-------------- next part --------------
The only difference between them is a single comma in an "a" command.
This comma is supposed to be optional.

In <http://www.w3.org/TR/SVG/paths.html#PathDataBNF>, the most relevant
productions are:

,----
| elliptical-arc:
|     ( "A" | "a" ) wsp* elliptical-arc-argument-sequence
| elliptical-arc-argument-sequence:
|     elliptical-arc-argument
|     | elliptical-arc-argument comma-wsp? elliptical-arc-argument-sequence
| elliptical-arc-argument:
|     nonnegative-number comma-wsp? nonnegative-number comma-wsp? 
|         number comma-wsp flag comma-wsp? flag comma-wsp? coordinate-pair
| flag:
|     "0" | "1"
| comma-wsp:
|     (wsp+ comma? wsp*) | (comma wsp*)
`----

We end up trying to parse "0,16,8" as "flag comma-wsp? flag comma-wsp?
coordinate-pair". This is supposed result in a flag of "0", another of
"1", and a coordinate-pair of "6,8".  No comma is needed between the "1"
and the "6", because a flag cannot be more than one digit long anyway.

Firefox and Chrom{e,ium} do fine with this.

Unfortunately, rsvg-convert does not actually do this; I'm not sure
exactly what it *does* do, but it's the difference between the former
and the latter of the enclosed PNGs.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rsvg-bad.png
Type: image/png
Size: 6130 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-gnome-maintainers/attachments/20140304/efbb148d/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rsvg-good.png
Type: image/png
Size: 5337 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-gnome-maintainers/attachments/20140304/efbb148d/attachment-0001.png>
-------------- next part --------------

-- System Information:
Debian Release: jessie/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 3.9-1-686-pae (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages librsvg2-bin depends on:
ii  libc6         2.17-97
ii  libcairo2     1.12.16-2
ii  libglib2.0-0  2.36.4-1
ii  libgtk-3-0    3.8.6-1
ii  librsvg2-2    2.40.0-1

librsvg2-bin recommends no packages.

librsvg2-bin suggests no packages.

-- no debconf information

-- 
Hi! I'm a .signature virus! Copy me into your ~/.signature to help me spread!