Comment 7 for bug 594120

Here's the valgrind output too.

==23610== Memcheck, a memory error detector
==23610== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==23610== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==23610== Command: eog /tmp/sample.svg
==23610==
==23610== Thread 2:
==23610== Conditional jump or move depends on uninitialised value(s)
==23610== at 0x77E154E: getAtts (rsvg-css.c:1170)
==23610== by 0x77E17FF: rsvg_css_parse_xml_attribute_string (rsvg-css.c:1238)
==23610== by 0x7801F5A: rsvg_processing_instruction (rsvg-base.c:919)
==23610== by 0x4BC43B5: xmlParsePI (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCEF03: ??? (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCFDC4: xmlParseChunk (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x78016D9: rsvg_handle_write_impl (rsvg-base.c:1128)
==23610== by 0x5B7CA33: gdk_pixbuf__svg_image_load_increment (io-svg.c:128)
==23610== by 0x477ED1D: gdk_pixbuf_loader_write (gdk-pixbuf-loader.c:473)
==23610== by 0x807C323: eog_image_load (eog-image.c:991)
==23610== by 0x808804F: eog_job_load_run (eog-jobs.c:336)
==23610== by 0x8087DA3: eog_job_run (eog-jobs.c:153)
==23610==
==23610== Invalid read of size 1
==23610== at 0x77E14D0: getAtts (rsvg-css.c:1190)
==23610== by 0x77E17FF: rsvg_css_parse_xml_attribute_string (rsvg-css.c:1238)
==23610== by 0x7801F5A: rsvg_processing_instruction (rsvg-base.c:919)
==23610== by 0x4BC43B5: xmlParsePI (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCEF03: ??? (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCFDC4: xmlParseChunk (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x78016D9: rsvg_handle_write_impl (rsvg-base.c:1128)
==23610== by 0x5B7CA33: gdk_pixbuf__svg_image_load_increment (io-svg.c:128)
==23610== by 0x477ED1D: gdk_pixbuf_loader_write (gdk-pixbuf-loader.c:473)
==23610== by 0x807C323: eog_image_load (eog-image.c:991)
==23610== by 0x808804F: eog_job_load_run (eog-jobs.c:336)
==23610== by 0x8087DA3: eog_job_run (eog-jobs.c:153)
==23610== Address 0x8f7d1ad is 0 bytes after a block of size 45 alloc'd
==23610== at 0x4024F20: malloc (vg_replace_malloc.c:236)
==23610== by 0x4ECEEBF: __vasprintf_chk (vasprintf_chk.c:82)
==23610== by 0x4B24ABE: g_vasprintf (in /lib/libglib-2.0.so.0.2400.1)
==23610== by 0x4B03505: g_strdup_vprintf (in /lib/libglib-2.0.so.0.2400.1)
==23610== by 0x4B03527: g_strdup_printf (in /lib/libglib-2.0.so.0.2400.1)
==23610== by 0x77E17D8: rsvg_css_parse_xml_attribute_string (rsvg-css.c:1235)
==23610== by 0x7801F5A: rsvg_processing_instruction (rsvg-base.c:919)
==23610== by 0x4BC43B5: xmlParsePI (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCEF03: ??? (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCFDC4: xmlParseChunk (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x78016D9: rsvg_handle_write_impl (rsvg-base.c:1128)
==23610== by 0x5B7CA33: gdk_pixbuf__svg_image_load_increment (io-svg.c:128)
==23610==
==23610== Invalid read of size 1
==23610== at 0x77E1496: getAtts (rsvg-css.c:1117)
==23610== by 0x77E17FF: rsvg_css_parse_xml_attribute_string (rsvg-css.c:1238)
==23610== by 0x7801F5A: rsvg_processing_instruction (rsvg-base.c:919)
==23610== by 0x4BC43B5: xmlParsePI (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCEF03: ??? (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCFDC4: xmlParseChunk (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x78016D9: rsvg_handle_write_impl (rsvg-base.c:1128)
==23610== by 0x5B7CA33: gdk_pixbuf__svg_image_load_increment (io-svg.c:128)
==23610== by 0x477ED1D: gdk_pixbuf_loader_write (gdk-pixbuf-loader.c:473)
==23610== by 0x807C323: eog_image_load (eog-image.c:991)
==23610== by 0x808804F: eog_job_load_run (eog-jobs.c:336)
==23610== by 0x8087DA3: eog_job_run (eog-jobs.c:153)
==23610== Address 0x8f7d1ae is 1 bytes after a block of size 45 alloc'd
==23610== at 0x4024F20: malloc (vg_replace_malloc.c:236)
==23610== by 0x4ECEEBF: __vasprintf_chk (vasprintf_chk.c:82)
==23610== by 0x4B24ABE: g_vasprintf (in /lib/libglib-2.0.so.0.2400.1)
==23610== by 0x4B03505: g_strdup_vprintf (in /lib/libglib-2.0.so.0.2400.1)
==23610== by 0x4B03527: g_strdup_printf (in /lib/libglib-2.0.so.0.2400.1)
==23610== by 0x77E17D8: rsvg_css_parse_xml_attribute_string (rsvg-css.c:1235)
==23610== by 0x7801F5A: rsvg_processing_instruction (rsvg-base.c:919)
==23610== by 0x4BC43B5: xmlParsePI (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCEF03: ??? (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCFDC4: xmlParseChunk (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x78016D9: rsvg_handle_write_impl (rsvg-base.c:1128)
==23610== by 0x5B7CA33: gdk_pixbuf__svg_image_load_increment (io-svg.c:128)
==23610==
==23610== Use of uninitialised value of size 4
==23610== at 0x77E14DC: getAtts (rsvg-css.c:1190)
==23610== by 0x77E17FF: rsvg_css_parse_xml_attribute_string (rsvg-css.c:1238)
==23610== by 0x7801F5A: rsvg_processing_instruction (rsvg-base.c:919)
==23610== by 0x4BC43B5: xmlParsePI (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCEF03: ??? (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCFDC4: xmlParseChunk (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x78016D9: rsvg_handle_write_impl (rsvg-base.c:1128)
==23610== by 0x5B7CA33: gdk_pixbuf__svg_image_load_increment (io-svg.c:128)
==23610== by 0x477ED1D: gdk_pixbuf_loader_write (gdk-pixbuf-loader.c:473)
==23610== by 0x807C323: eog_image_load (eog-image.c:991)
==23610== by 0x808804F: eog_job_load_run (eog-jobs.c:336)
==23610== by 0x8087DA3: eog_job_run (eog-jobs.c:153)
==23610==
==23610==
==23610== Process terminating with default action of signal 11 (SIGSEGV)
==23610== Access not within mapped region at address 0x90C0000
==23610== at 0x77E14D0: getAtts (rsvg-css.c:1190)
==23610== by 0x77E17FF: rsvg_css_parse_xml_attribute_string (rsvg-css.c:1238)
==23610== by 0x7801F5A: rsvg_processing_instruction (rsvg-base.c:919)
==23610== by 0x4BC43B5: xmlParsePI (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCEF03: ??? (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x4BCFDC4: xmlParseChunk (in /usr/lib/libxml2.so.2.7.6)
==23610== by 0x78016D9: rsvg_handle_write_impl (rsvg-base.c:1128)
==23610== by 0x5B7CA33: gdk_pixbuf__svg_image_load_increment (io-svg.c:128)
==23610== by 0x477ED1D: gdk_pixbuf_loader_write (gdk-pixbuf-loader.c:473)
==23610== by 0x807C323: eog_image_load (eog-image.c:991)
==23610== by 0x808804F: eog_job_load_run (eog-jobs.c:336)
==23610== by 0x8087DA3: eog_job_run (eog-jobs.c:153)
==23610== If you believe this happened as a result of a stack
==23610== overflow in your program's main thread (unlikely but
==23610== possible), you can try to increase the size of the
==23610== main thread stack using the --main-stacksize= flag.
==23610== The main thread stack size used in this run was 8388608.
==23610==
==23610== HEAP SUMMARY:
==23610== in use at exit: 2,165,862 bytes in 29,831 blocks
==23610== total heap usage: 176,393 allocs, 146,562 frees, 10,083,173 bytes allocated
==23610==
==23610== LEAK SUMMARY:
==23610== definitely lost: 191 bytes in 3 blocks
==23610== indirectly lost: 120 bytes in 10 blocks
==23610== possibly lost: 1,700,726 bytes in 24,202 blocks
==23610== still reachable: 464,825 bytes in 5,616 blocks
==23610== suppressed: 0 bytes in 0 blocks
==23610== Rerun with --leak-check=full to see details of leaked memory
==23610==
==23610== For counts of detected and suppressed errors, rerun with: -v
==23610== Use --track-origins=yes to see where uninitialised values come from
==23610== ERROR SUMMARY: 1322551 errors from 4 contexts (suppressed: 196 from 13)
Killed