cloudflare / svg-hush Goto Github PK

There are valid SVG's that are currently marked as invalid.

For example

r#"
<?xml version="1.0" encoding="utf-8"?>
<svg width="800px" height="800px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
<path d="M7 12H17M8 8.5C8 8.5 9 9 10 9C11.5 9 12.5 8 14 8C15 8 16 8.5 16 8.5M8 15.5C8 15.5 9 16 10 16C11.5 16 12.5 15 14 15C15 15 16 15.5 16 15.5M21 12C21 16.9706 16.9706 21 12 21C7.02944 21 3 16.9706 3 12C3 7.02944 7.02944 3 12 3C16.9706 3 21 7.02944 21 12Z" stroke="\#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
</svg>"#

This is because of the <?xml version="1.0" encoding="utf-8"?> preface. When this is removed, then the SVG validates correctly.

After introducing libfuzzer #2 (comment), found out that xms-rs crate has at least one place to crash with add to attempt with overflow.

Moreover xml-rs doesn't have contributions for almost a year and it seems to be abandoned.

cc @kornelski

Hi, I'm packaging this project for the Arch Linux User Repository (AUR). Please consider adding a LICENSE file to specify what this project is licensed under. I see it's listed as MIT or Apache in the Cargo.toml, but a license file helps clarify on GitHub.

Thanks for your time!