601131 - Firefox hangs with feTurbulence which has huge numOctaves

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Takeshi Kurosawa :takenspc]

SVG 1.1 allows content authors to specify loop count in |turblence| by numOctaves attribute.
http://www.w3.org/TR/SVG11/filters.html#feTurbulenceNumOctavesAttribute

And we use its value without any limitations.
http://mxr.mozilla.org/mozilla-central/source/content/svg/content/src/nsSVGFilters.cpp#3470

As a result, firefox hangs when loading an SVG file which contains feTurbulence which has huge numOctaves value.

We may be able to limit the loop count to some value.

Comment 1

[Takeshi Kurosawa :takenspc]

Attachment: Testcase (1 billion octaves)

Comment 2

[Robert Longson [:longsonr]]

Attachment: patch

octaves changes have a smaller and smaller effect as they grow larger. 10 was the largest value I found out in the wild.

Comment 3

[Robert Longson [:longsonr]]

https://tbpl.mozilla.org/?tree=Try&rev=f731497d6c43

Comment 4

[Robert Longson [:longsonr]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7edda78eca8b

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7edda78eca8b

Comment 6

[Ed Morley [:emorley]]

This landed on mozilla-central whilst it was still mozilla24, however mcMerge references the bugzilla target milestone field ordering, which was updated pre-emptively before the merge had occurred.