- Inkscape Devel - Inkscape Mailman

Inkscape 0.45.1 Released
by Aaron Spike 21 Mar '07

21 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Inkscape Community is proud to release Inkscape 0.45.1. This release include bug and security fixes. We recommend everyone upgrade. The source tarball is available at the URL below. Binary pacakges should begin to appear soon. https://sourceforge.net/project/showfiles.php?group_id=93438&package_id=991… Draw Freely. - -- Aaron Spike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (MingW32) iD8DBQFGABdH1wsJX4VXgboRAn+VAJ9zMhXLLE6cGqS/om1ls8HsmA0LJwCfUJ4I 8h2QmjV99R3jDpdj3bkwX44= =VzXR -----END PGP SIGNATURE-----

3 2

"make dist" fails
by Kees Cook 21 Mar '07

21 Mar '07

Some mingw stuff seems to be a bit off, but I didn't track it down: .... + make dist cd . && /bin/bash /scratch/ink-debs/inkscape/trunk/missing --run autoheader touch ./config.h.in make: *** No rule to make target `config.h.mingw', needed by `distdir'. Stop. -- Kees Cook @outflux.net

2 2

CorelDRAW Import
by Gail Banaszkiewicz 21 Mar '07

21 Mar '07

Random thought. I was thinking about the CorelDRAW import SoC project, and assuming to myself it may be best to stay away, since the potential IP problems *may* be even worse than working on text (which may actually be generic enough to not have to worry). HOWEVER I want you guys to know that I can help put together a bunch of test files, and even test the code of whoever ends up working on it (SoC or not). So don't forget! Gail

2 2

Ping (SoC)
by Eric Sumner 21 Mar '07

21 Mar '07

I'm here, like several others, because of Google's SoC. I am a Master's student in Mechanical Engineering at Southern Methodist University. I have kept an eye on Inkscape for several years, but I have only rarely had occasion to use it. I, like everyone else here (it seems), am interested in adding facilities that will make Inkscape easier to use to make 3D drawings. Being an engineer, I am also interested in being able to use it to make orthographic drawings. Aside from the 3D box tool, there are several features that might prove useful for 3D drawing: 1) Isometric/Axiometric grid 2) Diagonal guides (converging to a vanishing point) 3) Drawing with a prespecified transformation 4) Make Ctrl-dragging a node observe the object's transformation matrix 5) Perspective transformation (this would require somehow extending SVG's transformation mechanism) 6) Support for snapping non-node corners of rectangles I would be happy to work on any of these features over the summer. The usefulness of the first two seem obvious (to me), but the rest may take some explaining. Being able to set a transformation before you start drawing would allow you to, for example, set up drawing top faces for an isometric drawing, and have the rectangle tool work properly for those faces. Similarly, it would be useful to have a convenient way to move a node only along the basis vectors of an object's coordinate space, thus moving horizontally and vertically in the conceptual image. In conjunction with the previous two items, a perspective transformation would allow the same manipulations of orthographic images to be applied to perspective images. As for (6), this is usually taken care of by bounding-box snapping, but that doesn't work when the rectangle has undergone a transformation, making its corners not at the corners of its bounding box. Also, for bug #1674596, would an acceptable replacement for "Export Bitmap..." be "Render to File..."? This seems like an ideal bug for me to figure out the patch submission process because the change is only one line (I think; I haven't been able to test it yet). -- Eric Sumner

5 6

splash screen for 0.45.1
by momo 20 Mar '07

20 Mar '07

Hi! Since 0.45.1 is now out, I have a question about http://sourceforge.net/tracker/index.php?func=detail&aid=1683252&group_id=9… Has it been used and I should close it, or should I delete this patch? Thanks! Molumen I'm protected by SpamBrave http://www.spambrave.com/

2 2

NUBIE: extending pstricks output; printing subsystem
by Richard Henwood 20 Mar '07

20 Mar '07

Hi folks, I'm looking into fixing (text doesn't appear in output with latest SVN) and extending it to support embedding text as text. During a preliminary familiarisation hack, I've introduced a function: PrintLatex::text(Inkscape::Extension::Print *mod, char const *text, NR::Point p, SPStyle const *const style) (using ps.cpp as an example). I need the position of the text, and I was hoping that p[NR::X] and p[NR::Y] would give this, but they have the value 0.0000 0.0000 I'm new to cpp and Inkscape. Can you advise where I might be going wrong - and any wiki documents I should be checking in addition to PrintingSubsystem best regards, richard

2 1

Contributing...
by Jeff Schiller 20 Mar '07

20 Mar '07

I've become interested in Inkscape again and I'd like to figure out a good way to contribute. Here's a couple things I thought I'd throw out there: 1) I'm used to Bugzilla, has there been any discussion about moving away from a Sourceforge Bug Tracker into something a little more powerful (in terms of search? 2) In Mozilla, anyone can submit a patch to a bug, then the admins/super-reviewers must accept and merge the patch. Is there a mechanism for this within Inkscape? For instance, I'd like to report a bug against a SVG tutorial and then post a suggested fix for it that an admin can take and merge into the codebase. Similarly, my ambitions would be to get into the source code of Inkscape eventually and attempt another patch (this is more of a long-term goal though). Basically is there a way for the "casual" developer to submit patches in a standardized way? Thanks, Jeff

3 4

Security updates to Inkscape
by Kees Cook 20 Mar '07

20 Mar '07

Just before 0.45.1 was going to release I happened to do an audit of Inkscape's use of printf-style format strings (and the "..." argument). Unfortunately, there were multiple vulnerabilities[1]. Aaron gracefully delayed the final release so I could get CVEs issued, and notify other distributions. The basic problem the use of a *printf call directly on a variable without a format string. For example: printf(variable); vs printf("%s",variable); In the former, printf will parse any format chars in "variable", including the dangerous "%n", which allows for arbitrary memory overwriting. When functions use "..." to take in format strings for later processing by a *printf function, you can end up in the same situation. (Sorry to pick on ishmal's code, but it's a good example.) From the recent security fix commit: - status(event.getData().c_str()); + status("%s", event.getData().c_str()); "status" was defined as: virtual void status(const char *fmt, ...); Now, since the code is *filled* with format string "..." usage, it can be a real pain to find them all. Luckily, gcc has an attribute to flag a function as acting like a printf-family call, and Glib has a macro to create this attribute if gcc is being used as the compiler. So, now "status" is defined as: virtual void status(const char *fmt, ...) G_GNUC_PRINTF(2,3); The two args in G_GNUC_PRINTF point[2] to the format string variable, and the "..." argument. In the case of a class (as above) there is an implicit "this" argument as argument #1, meaning the format string "fmt" is really arg 2, and the "..." happens at position 3, as reflected in the G_GNUC_PRINTF usage. These markings, combined with the gcc compiler flag "-Wformat-security" will issue warnings about missing format strings, and do other strict type-checking. I've added this to the default CFLAGS as well. (And -D_FORTIFY_SOURCE=2, which adds even more protections via glibc.) Overall, many format issues were corrected[3], only a few of which were security-sensitive (37 files changed, 120 insertions(+), 111 deletions(-)). When making new "..."-using function, please review the glib macros for appropriate attributes, and take care to use them safely. I'd especially appreciate it if someone could look at: ./display/sp-canvas.h:SPCanvasItem *sp_canvas_item_new(SPCanvasGroup *parent, GtkType type, const gchar *first_arg_name, ...); This seems to be a NULL-terminated list (and not a format string, obviously), but it should get marked as such[4] if that's true. The dom/js/ tree is stuffed with "..." and I did not audit it, since it is not hooked up yet. However, we need to be very careful with it, and I'd MUCH prefer this code stayed outside of the inkscape code base so we can just link to an external library in the event of security updates to those libraries. Let me know if anyone has any questions; I'd like to keep inkscape as safe as possible. :) Thanks, -Kees [1] Try it yourself: prior to current trunk and 0.45.1, run this: inkscape /tmp/no-such-file-%x.svg And you'll see the "%x" turned into a number off the edge of the stack. The Jabber protocol handler was also vulnerable. [2] http://developer.gnome.org/doc/API/2.0/glib/glib-Miscellaneous-Macros.html#… [3] http://inkscape.svn.sourceforge.net/viewvc/inkscape?view=rev&revision=14554 [4] http://developer.gnome.org/doc/API/2.0/glib/glib-Miscellaneous-Macros.html#… -- Kees Cook @outflux.net

1 0

Hi everyone!!
by Celina Jorge 20 Mar '07

20 Mar '07

I arrive just now in this mailing list. At first, I have to say that my mother language isn't english, but portuguese, so I ask you to apologize any grammar/spell error. Here, in Brazil, I'm very interested in Inkscape plugins development, although I'm still trying write the first and studying things like SVG and XML. You also can find me in Inkscape-Brasil mailing list. It's a pleasure to be here. [ ]'s -- +..........................................................+ . Gmail:celina.jorge@...400... . . JID: celj@...1696... . . Msn: celina_jorge@...864... . . . . http://celde.wordpress.com . . http://www.cin.ufpe.br/~cinlug/planet/ . +...........................................................+

2 2

Re: [Inkscape-devel] Summer of Code 2007 - Possible application?
by Gail Banaszkiewicz 20 Mar '07

20 Mar '07

Hey Max! You seem to share the same enthusiasm as I do. You have beat me to the bug fixing though... I was hoping to do that this week along with putting together some proposals ;) > On second thought, the shared interest of two people could also be a > great advantage because maybe there is a way to split the project into > smaller parts which can be tackled more or less independently. I think that if this is possible, it's a really great idea. Our abilities seem to match up well, because as you say, you have a (probably) deeper understanding of the math, and I (may) have more programming experience given that my major is computer science rather than minor. Yet I imagine we are both sufficiently proficient in both aspects. I guess we can wait and see what the good mentoring folks say, but if we can come up with complementary proposals where we each have separate and sufficient work, I imagine our chances are good! I should note, though, that there are many suggested projects I am interested in, which somewhat deters me from wanting to come up with my own ideas ;) Instead, I may just try to put together a killer proposal for the suggested project ideas. We'll see what happens. My point here is mostly that if you turn out to be more suited for the 3D tool, there are no hard feelings. We should both put forward multiple proposals if possible and it would be nice if we could both get in. Looking forward to seeing how this will play out, Gail

3 3