bug#36773: 27.0.50; Accessing a cached SVG with eww can cause Emacs to crash

[Pip Cet]

On Wed, Jul 24, 2019 at 2:47 PM Eli Zaretskii <eliz@gnu.org> wrote:
> > From: Pip Cet <pipcet@gmail.com>
> > Date: Wed, 24 Jul 2019 13:24:46 +0000
> > Cc: 36773@debbugs.gnu.org
> >
> > As for the other bug, it's a little tricky: shr calls
> > url-store-in-cache after url-http-parse-headers has decompressed the
> > file, while url-http-parse-headers itself would (correctly) cache the
> > uncompressed file if it were configured to do so. It's not quite clear
> > who's at fault here.
>
> What's more, this problem doesn't happen in Emacs 26.2.90.  Can you
> see why it started happening in Emacs 27?  Maybe that will provide a
> hint as to how to fix it.

-      (zlib-decompress-region (point) (point-max)))))))
+      (zlib-decompress-region (point) (point-max) t))))))

The allow-partial flag means to delete rather than simply leave the
(uncompressed) data in place.

So I guess that is a hint, we could just go back to the Emacs-26
behavior. I don't think we should, but in practice it should work
okay.

> Btw, I see the same behavior as you, Pip: g_object_unref error
> messages and no crash.  librasvg returns a NULL handle, but it also
> returns a non-zero err.  My librsvg version is 2.40.1.

The bug in librsvg was introduced between 2.40.1 and 2.40.13, and has
been fixed again since. 2.40.13 does:

    if (g_buffered_input_stream_fill (G_BUFFERED_INPUT_STREAM
(stream), 2, cancellable, error) != 2) {
        g_object_unref (stream);
        return FALSE;
    }

Which returns without an error filled in if stream doesn't contain at
least two bytes.