Bug 393832 - svg circle with infinite radius causes hang. r=jwatt

content/svg/content/src/nsSVGAngle.cpp

@@ -209,7 +209,7 @@ GetValueFromString(const nsAString &aValueAsString,
   
   char *rest;
   *aValue = float(PR_strtod(str, &rest));
-  if (rest != str) {
+  if (rest != str && NS_FloatIsFinite(*aValue)) {
     *aUnitType = GetUnitTypeForString(rest);
     if (IsValidUnitType(*aUnitType)) {
       return NS_OK;

content/svg/content/src/nsSVGDataParser.cpp

@@ -49,6 +49,7 @@
 
 
 #include "nsSVGDataParser.h"
+#include "nsContentUtils.h"
 #include "prdtoa.h"
 #include "nsSVGUtils.h"
 #include <stdlib.h>
@@ -151,10 +152,12 @@ nsresult nsSVGDataParser::MatchNonNegativeNumber(float* aX)
   }
 
   char* end;
-  *aX = (float) PR_strtod(pos, &end);
-  NS_ASSERTION(end == mTokenPos, "number parse error");
+  *aX = float(PR_strtod(pos, &end));
+  if (pos != end && NS_FloatIsFinite(*aX)) {
+    return NS_OK;
+  }
   
-  return NS_OK;
+  return NS_ERROR_FAILURE;
 }
 
 PRBool nsSVGDataParser::IsTokenNonNegativeNumberStarter()
@@ -181,10 +184,12 @@ nsresult nsSVGDataParser::MatchNumber(float* aX)
   }
 
   char* end;
-  *aX = (float) PR_strtod(pos, &end);
-  NS_ASSERTION(end == mTokenPos, "number parse error");
-               
-  return NS_OK;
+  *aX = float(PR_strtod(pos, &end));
+  if (pos != end && NS_FloatIsFinite(*aX)) {
+    return NS_OK;
+  }
+  
+  return NS_ERROR_FAILURE;
 }
 
 PRBool nsSVGDataParser::IsTokenNumberStarter()

content/svg/content/src/nsSVGElement.cpp

@@ -1544,7 +1544,7 @@ nsSVGElement::ParseNumberOptionalNumber(const nsAString& aValue,
   float x = float(PR_strtod(str, &rest));
   float y = x;
 
-  if (str == rest) {
+  if (str == rest || !NS_FloatIsFinite(x)) {
     //first value was illformed
     return NS_ERROR_FAILURE;
   }
@@ -1558,7 +1558,7 @@ nsSVGElement::ParseNumberOptionalNumber(const nsAString& aValue,
     }
 
     y = float(PR_strtod(rest, &rest));
-    if (*rest != '\0') {
+    if (*rest != '\0' || !NS_FloatIsFinite(y)) {
       //second value was illformed or there was trailing content
       return NS_ERROR_FAILURE;
     }

content/svg/content/src/nsSVGLength2.cpp

@@ -166,7 +166,7 @@ GetValueFromString(const nsAString &aValueAsString,
   
   char *rest;
   *aValue = float(PR_strtod(str, &rest));
-  if (rest != str) {
+  if (rest != str && NS_FloatIsFinite(*aValue)) {
     *aUnitType = GetUnitTypeForString(rest);
     if (IsValidUnitType(*aUnitType)) {
       return NS_OK;

content/svg/content/src/nsSVGNumber.cpp

@@ -120,17 +120,18 @@ nsSVGNumber::SetValueString(const nsAString& aValue)
   nsresult rv = NS_OK;
   WillModify();
   
-  char *str = ToNewCString(aValue);
+  NS_ConvertUTF16toUTF8 value(aValue);
+  const char *str = value.get();
 
   if (*str) {
     char *rest;
-    double value = PR_strtod(str, &rest);
-    if (rest && rest!=str) {
+    float val = float(PR_strtod(str, &rest));
+    if (rest && rest!=str && NS_FloatIsFinite(val)) {
       if (*rest=='%') {
-        rv = SetValue(float(value/100.0));
+        rv = SetValue(val / 100.0f);
         rest++;
       } else {
-        rv = SetValue(float(value));
+        rv = SetValue(val);
       }
       // skip trailing spaces
       while (*rest && isspace(*rest))
@@ -146,7 +147,6 @@ nsSVGNumber::SetValueString(const nsAString& aValue)
       // no number
     }
   }
-  nsMemory::Free(str);
   DidModify();
   return rv;
 }

content/svg/content/src/nsSVGNumber2.cpp

@@ -92,7 +92,7 @@ nsSVGNumber2::SetBaseValueString(const nsAString &aValueAsString,
   
   char *rest;
   float val = float(PR_strtod(str, &rest));
-  if (rest == str || *rest != '\0') {
+  if (rest == str || *rest != '\0' || !NS_FloatIsFinite(val)) {
     return NS_ERROR_FAILURE;
   }
 

content/svg/content/src/nsSVGNumberList.cpp

@@ -132,8 +132,7 @@ nsSVGNumberList::SetValueString(const nsAString& aValue)
 
   nsresult rv = NS_OK;
 
-  char* str;
-  str = ToNewCString(aValue);
+  char* str = ToNewCString(aValue);
 
   char* rest = str;
   char* token;
@@ -141,10 +140,10 @@ nsSVGNumberList::SetValueString(const nsAString& aValue)
 
   while ((token = nsCRT::strtok(rest, delimiters, &rest))) {
     char *left;
-    double value = PR_strtod(token, &left);
-    if (token!=left) {
+    float val = float(PR_strtod(token, &left));
+    if (token!=left && NS_FloatIsFinite(val)) {
       nsCOMPtr<nsIDOMSVGNumber> number;
-      NS_NewSVGNumber(getter_AddRefs(number), float(value));
+      NS_NewSVGNumber(getter_AddRefs(number), val);
       if (!number) {
         rv = NS_ERROR_FAILURE;
         break;

content/svg/content/src/nsSVGPointList.cpp

@@ -175,19 +175,19 @@ nsSVGPointList::SetValueString(const nsAString& aValue)
 
     char *end;
     
-    double x = PR_strtod(token1, &end);
-    if (*end != '\0') {
+    float x = float(PR_strtod(token1, &end));
+    if (*end != '\0' || !NS_FloatIsFinite(x)) {
       rv = NS_ERROR_FAILURE;
       break; // parse error
     }
-    double y = PR_strtod(token2, &end);
-    if (*end != '\0') {
+    float y = float(PR_strtod(token2, &end));
+    if (*end != '\0' || !NS_FloatIsFinite(y)) {
       rv = NS_ERROR_FAILURE;
       break; // parse error
     }
     
     nsCOMPtr<nsIDOMSVGPoint> point;
-    NS_NewSVGPoint(getter_AddRefs(point), (float)x, (float)y);
+    NS_NewSVGPoint(getter_AddRefs(point), x, y);
     if (!point) {
       rv = NS_ERROR_OUT_OF_MEMORY;
       break;
@@ -198,8 +198,7 @@ nsSVGPointList::SetValueString(const nsAString& aValue)
   if (token1 || NS_FAILED(rv)) {
     // there was a parse error or we ran out of memory
     rv = NS_ERROR_FAILURE;
-  }
-  else {
+  } else {
     WillModify();
     ReleasePoints();
     PRInt32 count = points.Count();

content/svg/content/src/nsSVGStopElement.cpp

@@ -140,8 +140,8 @@ nsSVGStopElement::ParseAttribute(PRInt32 aNamespaceID,
       const char *str = value.get();
 
       char *rest;
-      float offset = static_cast<float>(PR_strtod(str, &rest));
-      if (str != rest) {
+      float offset = float(PR_strtod(str, &rest));
+      if (str != rest && NS_FloatIsFinite(offset)) {
         if (*rest == '%') {
           offset /= 100;
           ++rest;

content/svg/content/src/nsSVGTransformSMILAttr.cpp

@@ -228,7 +228,7 @@ nsSVGTransformSMILAttr::ParseParameterList(const nsAString& aSpec,
     char const *arg = start.get();
     char *argend;
     float f = float(PR_strtod(arg, &argend));
-    if (arg == argend || argend > end.get())
+    if (arg == argend || argend > end.get() || !NS_FloatIsFinite(f))
       return -1;
 
     if (numArgsFound < aNVars) {

content/svg/content/src/nsSVGViewBox.cpp

@@ -115,15 +115,15 @@ nsSVGViewBox::SetBaseValueString(const nsAString& aValue,
   const char *delimiters = ",\x20\x9\xD\xA";
 
   float vals[4];
-  int i;
-  for (i=0;i<4;++i) {
+  PRUint32 i;
+  for (i = 0; i < 4; ++i) {
     if (!(token = nsCRT::strtok(rest, delimiters, &rest))) break; // parse error
 
     char *end;
-    vals[i] = (float)PR_strtod(token, &end);
-    if (*end != '\0') break; // parse error
+    vals[i] = float(PR_strtod(token, &end));
+    if (*end != '\0' || !NS_FloatIsFinite(vals[i])) break; // parse error
   }
-  if (i!=4 || (nsCRT::strtok(rest, delimiters, &rest)!=0)) {
+  if (i!=4 || nsCRT::strtok(rest, delimiters, &rest)!=0) {
     // there was a parse error.
     rv = NS_ERROR_FAILURE;
   } else {