- Inkscape Devel - Inkscape Mailman

Hyphenation for text-justify
by Stefan de Konink 18 Oct '05

18 Oct '05

Hello, >From the Jabber conversation, bryyyce pointed me to the dev mailinglist. For our local Radio/TV-broadcasting foundation I made some software that makes a cable-text-program from SVG documents. Basically it works like this: Webinterface -> SQLite SQLite -> XML + XSL -> SVG SVG -> PNG PNG -> xloadimage Currently we need to wrap our text by hand, I'm extremely happy with the working flowtext. But speaking about nice features, justifying text and auto-hyphenation would be a killer app. I heard pjrm and njh have some ideas for this. The software is give-a-way GPL. So basically it spreads now around, not making it public (as in website) until all bugs are out of it though. (Any interest can receive a tarbal) Greetings, Stefan de Konink

3 2

Re: [Inkscape-devel] Re: Sanity checking files on open
by Ben Fowler 18 Oct '05

18 Oct '05

On 10/17/05, jiho <jo.irisson@...400...> wrote: > On 17 oct. 05, at 10:45, Ben Fowler wrote: > > On 10/16/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 20:23, Ben Fowler wrote: > >>> On 10/15/05, jiho <jo.irisson@...400...> wrote: > >>>> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>>>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > > > > If it is necessary to 'fix up' objects individually, then you might > > want to select them one at a time and check the appearance > > and/or the properties. > > In this case, the problem was that the object had a huge bbox but was > invisible, so impossible to select individually. But I am conscious > that this is an individual problem and that general behavior should > be the one you advise. I think that you can select it (and that would agree with the comment that Bulia Byak made), and that would have the advantage that you could do whatever you needed to/decided to do to fix the problem, rather than say yes or no to some 'action at a distance'. If not (though this may be a low priority issue) then we ought to think about how to select hidden or invisible objects. Ben

1 0

win98 support?
by lode leroy 18 Oct '05

18 Oct '05

Does anyone know if installing "Microsoft Layer for Unicode on Windows 95, 98, and Me Systems" on a win98 pc makes it possible to use cairo and thus inkscape / gimp / ...? http://www.microsoft.com/downloads/details.aspx?FamilyID=73ba7bd7-ed06-4f0d…

4 4

Articifical Limits (was Re: Sanity checking files on open)
by Ben Fowler 17 Oct '05

17 Oct '05

On 10/16/05, jiho <jo.irisson@...400...> wrote: > On 15 oct. 05, at 20:23, Ben Fowler wrote: > > On 10/15/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > > > Having said that, perhaps Inkscape compiled in debug mode should > > have some of these artifical limits, (just as we have assertion > > statements). It will help identify to developers just where the > > shoe pinches, but users do not need to handle this. > > If they could, why not? Once you pointed me to the problem the fix > was really easy. Having that build into inkscape would have avoided > you all my long emails ;-) Not really, the root cause of this e-mail conversation (maybe lengthy, but not unnecessary) is the fact that Inkscape did not gracefully handle a specific error condition. This wasn't deliberate. It was just that the precise combination of circumstances that brings it about had not occurred to any of the developers who had worked on that part of the code. Bringing this up up was very necessary. This kind of bug report is one of the most important raw materials needed for the production of good software. Now, release versions should not have 'articifical limits' or training wheels. Th assumption is that if the Application is in an unexpected state with a developer, it is because he or she got something wrong, and we want the earliest indication of when this is happening. If the application is in an unexpected state with a user, then the user is probably 'in the right' and merely doing something that hadn't been tested or anticipated. In the present case, if a scale factor exceeds 1 million, we are going to guess that on a developer's machine there is something wrong the code, but on a user's machine that he or she is simply working with large objects. Ben

5 5

[joxeankoret_at_yahoo_dot_es: Bug#330894: inkscape: Arbitrary code execution when opening a malicious file]
by Wolfram Quester 17 Oct '05

17 Oct '05

Hi allotogether, I just received a message at debian's BTS [1] which reports a possible security flaw in inkscape. It is surely a DOS since here on my PowerBook inkscape simply crashes saying wolfi@...453...:/tmp $ inkscape poc.svg Emergency save activated! Segmentation fault (core dumped) I attach the backtrace, which shows that inkscape is rather irritated: Core was generated by `aaaaaaaaaaaaaaaaa'. BTW, vim's syntax highlighter has certain toubles when editing this file, too. Thanks, Wolfi [1] http://bugs.debian.org/330894 ----- Forwarded message from Joxean Koret <joxeankoret_at_yahoo_dot_es> ----- Subject: Bug#330894: inkscape: Arbitrary code execution when opening a malicious file Reply-To: Joxean Koret <joxeankoret_at_yahoo_dot_es>, 330894@...499... Resent-From: Joxean Koret <joxeankoret_at_yahoo_dot_es> Resent-To: debian-bugs-dist@...501... Resent-Cc: Wolfram Quester <wolfi@...111...> Resent-Date: Fri, 30 Sep 2005 10:48:06 UTC Resent-Message-ID: <handler.330894.B.11280765119494@...499...> X-Debian-PR-Message: report 330894 X-Debian-PR-Package: inkscape X-Debian-PR-Keywords: From: Joxean Koret <joxeankoret_at_yahoo_dot_es> To: submit@...499... Date: Fri, 30 Sep 2005 12:51:04 +0200 Resent-Sender: Debian BTS <debbugs@...499...> X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at honk.physik.uni-konstanz.de X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at honk.physik.uni-konstanz.de Subject: inkscape: Arbitrary code execution opening a file Package: inkscape Version: 0.41-4.99.sarge0 Severity: grave Justification: user security hole Inkscape is vulnerable to, almost, one buffer overflow that may allow arbitrary code execution. I contacted the Inkscape team but, at the moment, there is no patch for the issue. Attached goes a Proof Of Concept. NOTE: I think the problem may not be exploitable because you need to write a shellcode using only valid XML characters. Regards, Joxean Koret -- System Information: [...snip...] ----- End forwarded message -----

5 7

Re: [Inkscape-devel] Static RPM isn't Very Static
by DJA 17 Oct '05

17 Oct '05

Jean-Francois Lemaire wrote: > On Friday 14 October 2005 20:00, you wrote: > >>Jean-Francois Lemaire wrote: >> >>>I've just uploaded inkscape-0.42.2-0.static.i686.rpm to >>>SourceForge. Would you please check it out and report back? > > >>That fixed that problem, but...umm...here's a new one: >> >>[dallen@...1044... miscellaneous]$ inkscape >>inkscape: error while loading shared libraries: >>libpangocairo-1.0.so.0: cannot open shared object file: No such file >>or directory > > > libpangocairo is not statically linked on purpose. It's not unreasonable to expect the user to install some support libraries or tweak the run-time environment. However, if there are libraries required by the package, then it shouldn't be called a static package. > Aren't you able to install it on your system? Isn't it part of your distribution? I will look for that library. No, Cairo[1] is not part of the Fedora Core distribution, and this is a full ("Install everything") install. Neither is Inkscape, BTW. > We can't link statically every library needed by Inkscape. Fair enough. But then you shouldn't call that package static. > We have to make reasonable choices. Now, maybe libpangocairo should be added. Your choice. Just let the users know what is required to install the package or binary. If there are library or environment requirements for the Inkscape package, then those requirements should be listed on the download (or some conspicuous) page on the Web site, preferably with links pointing to wherever contemporary versions of those files/packages can be found. [1] I'm assuming 'Cairo' is the library name - I'm not familiar with it. No doubt you will have many users new to your app who are not up to speed on all the latest graphics libraries and support packages. All the more reason to spell out exactly what one needs to experience your app. -- Best Regards, ~DJA.

5 9

Re: Sanity checking files on open
by Ben Fowler 17 Oct '05

17 Oct '05

On 10/16/05, jiho <jo.irisson@...400...> wrote: > On 15 oct. 05, at 20:23, Ben Fowler wrote: > > On 10/15/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > >> > OK with this: > If the file cannot be read if not corrected (=definition of error > for me) the fix should be automatic. > . if the file can be read (as it was for mine: the syntax was OK) but > contains some unusual values, the correction should not be made > automatically. but, in addition of issuing a warning, I think it > would be great if a fix was proposed. then the user can choose to > accept it (in most cases, yes) or to reject it (in this case user > probably know what he is doing and will reject it if necessary). > In addition to that... This is RFE [ 1119025 ] repair broken xml on load http://sourceforge.net/tracker/index.php?func=detail&aid=1119025&group_id=9… You might want to: * Add a comment there * Put it onto the roadmap * Add a wiki page to record progress Note that this may not be 'interesting' to an open source developer, and you may find that progress is sporadic, but if a start is made so that there is a place to add code for handling new sorts of errors, I expect that eventually this will get done. Ben

1 0

Re: Sanity checking files on open
by Ben Fowler 17 Oct '05

17 Oct '05

On 10/16/05, jiho <jo.irisson@...400...> wrote: > On 15 oct. 05, at 20:23, Ben Fowler wrote: > > On 10/15/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > > - that some criteria are chosen in the sanity check and some fixes > are proposed when these criteria are met. As I mentioned before, I am > thinking about scaling objects that have insane bbox or that are > really big/small in comparison with the rest of the drawing. Or even > scaling the whole drawing if it is huge (as it was the case > previously with somebody who couldn't zoom out far enough to see the > whole drawing if I remember well) or tiny (as it is the case with the > other file I have). And having the possibility to accept or reject > any change individually make this feature not too intrusive. Once > again I don't know if all this even means something. Just correct me > if this is stupid. If it is necessary to 'fix up' objects individually, then you might want to select them one at a time and check the appearance and/or the properties. Ben

1 0

Fix Error handling first (wasRe: Sanity checking files on open)
by Ben Fowler 17 Oct '05

17 Oct '05

On 10/16/05, jiho <jo.irisson@...400...> wrote: > On 15 oct. 05, at 20:23, Ben Fowler wrote: > > On 10/15/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > > [ snip ] > > To help this I can provide plenty of buggy files to play with ;-) > Scilab and other math plotting software apparently produce eps files > that pstoedit/inkscape do not like at all. Yes, we should have a corpus of files that cause problems for Inkscape (and/or sister programs whether valid or invalid. You might want to take this to the testers list Ben

1 0

Sanity checking files on open (was Re: [Inkscape-devel] zooming bug)
by Ben Fowler 17 Oct '05

17 Oct '05

On 10/15/05, jiho <jo.irisson@...400...> wrote: I am assuming that you meant to post to the list. > On 15 oct. 05, at 18:34, Ben Fowler wrote: > > On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > > Assuming that in general we cannot expect Inkscape to determine > > whether or not a bounding box is insane, I was thinking that we > > might exclude some items from the bbox estimation to make the > > behaviour less surprising. > > I think some could be determined at least. For example, if only one > object is insane this could be found: if all transform look like > 1,0,1,0,0,1 and one is 10e15,0, 10e15... it is very probably wrong. > This could be detected and corrected at openning time and if the user > wants to see the unmodified file anyway he could just cancel the > correction. This would allow users with specific needs to edit their > files anyway. Could I make sure that we are distinguishing at leaast two cases here? The first is when a file is in error, and the fix is forced. If possible, we should always do this. (I suspect that where this is not possible, we open in the XML editor, if even this is not possible, we show a helpful diagnostic - but this is not the current topic). The second is when the file is not in error, but contains some suspicious values, and we want to warn. This happens in Freehand when a bitmap cannot be found or a requested font is missing. Now I think that it is often a mistake for an application to put up a modal dialog and demand that the user pay attention. In some cases. the time to warn is just before saving, or to require that the file is saved under a new name, to ensure that the user does not lose data. If the application feels that a file has 'warnings' (non fatal errors or failure of sanity checking) there should be an annunciator in a margin that one can click on to see details. Additionally or alternatively there should be a menu item: Verify File that would check the file with great rigour. Think of it as Norton's Disk Doctor for SVG. (We have a menu item: Vacuum Defs that is cognate to 'Speed Disk'). The problem with performing rigorous sanity checking at every start-up (file read), particularly by default is that we cannot as developers really know how long this will take, but we can be pretty sure that 9999 times out of 10 000 it is not necessary: It is a little user hostile. O.K. We can do some statistical analysis of a) The diagonals, b) The x position and c) the y position of every bounding box, and by looking at twice the standard deviation determine if the out-liers were lying out too far. The trouble with this approach is that it is the 'fool proof' approach, just making as a system proof against a fool only works until a better one comes along, this appraoch will be defeated in the field by the great variety of insane files. Whether we like it or not, people are going to have to be opening SVG files with text editor (or the built-in XML editor) to fix problems with insane files for some time to come. It is madness to pretend otherwise. Having said that, perhaps Inkscape compiled in debug mode should have some of these artifical limits, (just as we have assertion statements). It will help identify to developers just where the shoe pinches, but users do not need to handle this. Ben

2 2