#145 [BUG] Null Pointer Dereference in put_patternarc, genpict2e.c:2405

[Han Zheng]

Hello, I was testing my fuzzer and find a null pointer dereference in fig2dev. Here are the details

short describe

There is a null pointer dereference in fig2dev, in function put_patternarc, genpict2e.c:2405.

environment

fig2dev latest commit 6678ad8cbf99fdbd9e0929fb26501d1f01f36698,
gcc 11.2.0
Ubuntu 22.04

step to reproduce

compile with CC="gcc -g -fsanitize=address", run ./fig2dev -L pict2e $POC

ASan Log

\unitlength4144sp% 4143.7 sp = (1/472.44) cm
\begin{picture}(9990,8904)%(0,0)
\ifx\allinethickness\undefined
  \def\XFigeepicthickness#1{\relax}
\else
  \let\XFigeepicthickness\allinethickness
\fi
{\color[rgb]{0,0.69,0.69}
\polygon*(5265,7581)(5265,4431)(7965,3081)(7965,6231)
\color{black}
\linethickness{7.5\unitlength}\XFigeepicthickness{7.5\unitlength}%\thinlines
\polygon(5265,7581)(5265,4431)(7965,3081)(7965,6231)
\color[rgb]{0.9,0.9,1}
\polygon*(2521,4941)(2521,1791)(5221,441)(5221,3591)
\color{black}
\polygon(2521,4941)(2521,1791)(5221,441)(5221,3591)
\color{white}
\moveto(6525,6006)\curveto(6754,6006)(6940,5724)(6940,5376)\curveto(6940,5028)(6754,4746)(6525,4746)
\curveto(6296,4746)(6110,5028)(6110,5376)\curveto(6110,5724)(6296,6006)(6525,6006)\closepath\fillpath
\color{black}
\moveto(6525,6006)\curveto(6754,6006)(6940,5724)(6940,5376)\curveto(6940,5028)(6754,4746)(6525,4746)
\curveto(6296,4746)(6110,5028)(6110,5376)\curveto(6110,5724)(6296,6006)(6525,6006)\closepath\strokepath
\put(6121,3366){\makebox(0,0)[lb]{\smash{\fontsize{24}{28.8}\usefont{T1}{pnc}{m}{it}E}}}
\put(6346,3261){\makebox(0,0)[lb]{\smash{\fontsize{16}{19.2}\usefont{T1}{pnc}{m}{it}x}}}
\color{red}
\polygon*(6693,4734)(6751,4709)(6812,4723)
\linethickness{15\unitlength}\XFigeepicthickness{15\unitlength}%\thicklines
\polygon(6693,4734)(6751,4709)(6812,4723)
\polygon*(7080,5596)(7020,5594)(6960,5591)
\polygon(7080,5596)(7020,5594)(6960,5591)
\circlearc[1]{47}{5319}{6855}{-4.967}{2.195}\strokepath
\color{black}
\linethickness{30\unitlength}\XFigeepicthickness{30\unitlength}%
\Line(126,2676)(1101,79)
\polygon*(1021,33)(1106,65)(1190,97)
\polygon(1021,33)(1106,65)(1190,97)
\linethickness{15\unitlength}\XFigeepicthickness{15\unitlength}%\thicklines
\multiput(8551,7236)(180,-2.3){5}{\line(90,-1){90}}
\Line(9451,7224)(9472,7224)
\polygon(9478,7164)(9719,7221)(9479,7284)
\multiput(8491,7236)(0,180){5}{\line(0,1){90}}
\Line(8491,8136)(8491,8157)
\polygon(8551,8164)(8491,8404)(8431,8164)
\linethickness{30\unitlength}\XFigeepicthickness{30\unitlength}%
\multiput(7684,6378)(-175.2,-164){5}{\line(-44,-41){88}}
\multiput(4936,3741)(-172.8,-166.6){6}{\line(-86,-83){86}}
\Line(3899,2741)(3868,2711)
\Line(8551,7251)(7703,6404)
\put(9346,6876){\makebox(0,0)[lb]{\smash{\fontsize{24}{28.8}\usefont{T1}{pnc}{m}{it}x}}}
\put(8686,8121){\makebox(0,0)[lb]{\smash{\fontsize{24}{28.8}\usefont{T1}{pnc}{m}{it}y}}}
\put(1036,381){\makebox(0,0)[lb]{\smash{\fontsize{24}{28.8}\usefont{T1}{pnc}{m}{it}z}}}
\put(4486,5016){\makebox(0,0)[lb]{\smash{\fontsize{24}{28.8}\usefont{T1}{pnc}{m}{it}E}}}
\put(62,8536){\makebox(0,0)[lb]{\smash{\fontsize{16}{19.2}\usefont{T1}{pnc}{m}{it}1455 5355 8115 Polariser}}}
\put(7966,8061){\makebox(0,0)[lb]{\smash{\fontsize{24}{28.8}\usefont{T1}{pnc}{m}{it}E}}}
\put(8206,7986){\makebox(0,0)[lb]{\smash{\fontsize{16}{19.2}\usefont{T1}{pnc}{m}{it}y}}}
\put(1666,2286){\makebox(0,0)[lb]{\smash{\fontsize{24}{28.8}\usefont{T1}{pnc}{m}{it}E}}}
\put(1921,2226){\makebox(0,0)[lb]{\smash{\fontsize{16}{19.2}\usefont{T1}{pnc}{m}{it}y}}}
\Line(6886,5631)(4951,3741)
\circlearc[1]{8002}{5361}{3717}{190.15}{-148.84}\closepath\fillpath
AddressSanitizer:DEADLYSIGNAL
=================================================================
==438858==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x55e62b98adf8 bp 0x60c000000100 sp 0x7ffc15cd4a00 T0)
==438858==The signal is caused by a READ memory access.
==438858==Hint: address points to the zero page.
    #0 0x55e62b98adf8 in put_patternarc /validate/mcj-fig2dev/fig2dev/dev/genpict2e.c:2405
    #1 0x55e62b98cc6b in genpict2e_arc /validate/mcj-fig2dev/fig2dev/dev/genpict2e.c:2549
    #2 0x55e62b90ddfb in gendev_objects /validate/mcj-fig2dev/fig2dev/fig2dev.c:1026
    #3 0x55e62b90ddfb in main /validate/mcj-fig2dev/fig2dev/fig2dev.c:502
    #4 0x7fcbeaaa8d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #5 0x7fcbeaaa8e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #6 0x55e62b90e9a4 in _start (/validate/mcj-fig2dev/fig2dev/fig2dev+0x6e9a4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /validate/mcj-fig2dev/fig2dev/dev/genpict2e.c:2405 in put_patternarc
==438858==ABORTING

PoC

as shown in the attachment

Credit

Han Zheng(NCNIPC of China, Hexhive)
Yin Li, Xiaotong Jiao (NCNIPC of China)

[tkl]

Fixed with commit [ed4d04]. For a description of the bug, see ticket [#148].

[Han Zheng]

Fix Credit:
Han Zheng(NCNIPC of China, Hexhive)
Yin Li, Xiaotong Jiao (NCNIPC of China)

[tkl]

Do you want me to edit and change the credit line of your original postings, for tickets 145–148?

[Han Zheng]

If you have time to do so, thanks a lot!