Menu

#449 Null pointer dereference in InsertRow()

v1.0_(example)
closed-fixed
None
5
2017-09-10
2017-08-28
No

After some fuzz testing I found a crashing test case.

Changeset: 15133:198ea602ea7c

Command: gm convert -negate -clip gm_nullptr_InsertRow /dev/null

ASAN Context:

==5349==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000009049af bp 0xfffffffffffffffc sp 0x7ffd1168fdd0 T0)
==5349==The signal is caused by a WRITE memory access.
==5349==Hint: address points to the zero page.
    #0 0x9049ae in InsertRow /home/kamilf/GM/coders/wpg.c:288:25
    #1 0x901b25 in UnpackWPGRaster /home/kamilf/GM/coders/wpg.c:421:17
    #2 0x901b25 in ReadWPGImage /home/kamilf/GM/coders/wpg.c:1123
    #3 0x595019 in ReadImage /home/kamilf/GM/magick/constitute.c:1607:13
    #4 0x51a1c0 in ConvertImageCommand /home/kamilf/GM/magick/command.c:4348:22
    #5 0x52fcf1 in MagickCommand /home/kamilf/GM/magick/command.c:8869:17
    #6 0x567933 in GMCommandSingle /home/kamilf/GM/magick/command.c:17396:10
    #7 0x566633 in GMCommand /home/kamilf/GM/magick/command.c:17449:16
    #8 0x7faf54ef082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x41beb8 in _start (/usr/local/bin/gm+0x41beb8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/kamilf/GM/coders/wpg.c:288:25 in InsertRow
==5349==ABORTING
1 Attachments

Discussion

  • Bob Friesenhahn

    Bob Friesenhahn - 2017-09-10
    • assigned_to: Bob Friesenhahn
     
  • Bob Friesenhahn

    Bob Friesenhahn - 2017-09-10

    Fixed by Mercurial changeset 15161:3dc7b4e3779d.

     
  • Bob Friesenhahn

    Bob Friesenhahn - 2017-09-10
    • status: open --> closed-fixed
     

Log in to post a comment.

MongoDB Logo MongoDB