#147 [BUG] Null Pointer Dereference in put_arrow,genpict2e.c:1169

[Han Zheng]

Hello, I was testing my fuzzer and find a Null Pointer Dereference in fig2dev. Here are the details

short describe

There is a null pointer dereference in fig2dev, in function put_arrow, genpict2e.c:1169

environment

fig2dev latest commit 6678ad8cbf99fdbd9e0929fb26501d1f01f36698,
gcc 11.2.0
Ubuntu 22.04

step to reproduce

compile with CC="gcc -g -fsanitize=address", run ./fig2dev -L pict2e $POC

ASan Log

\unitlength414373sp% 4143.7 sp = (1/472.44) cm
\begin{picture}(-2147483642,-2147483639)%(0,0)
\ifx\allinethickness\undefined
  \def\XFigeepicthickness#1{\relax}
\else
  \let\XFigeepicthickness\allinethickness
\fi
{\color{red}
\beveljoin%
\polyline(-2147483643,7)(-2147483643,1)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2970562==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000009 (pc 0x561adc666ca6 bp 0x7fff1f3976f0 sp 0x7fff1f3976d0 T0)
==2970562==The signal is caused by a READ memory access.
==2970562==Hint: address points to the zero page.
    #0 0x561adc666ca6 in put_arrow /validate/mcj-fig2dev/fig2dev/dev/genpict2e.c:1169
    #1 0x561adc66931d in put_poly_or_patternline /validate/mcj-fig2dev/fig2dev/dev/genpict2e.c:1555
    #2 0x561adc66931d in genpict2e_line /validate/mcj-fig2dev/fig2dev/dev/genpict2e.c:1814
    #3 0x561adc5f0dfb in gendev_objects /validate/mcj-fig2dev/fig2dev/fig2dev.c:1026
    #4 0x561adc5f0dfb in main /validate/mcj-fig2dev/fig2dev/fig2dev.c:502
    #5 0x7f8380e62d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #6 0x7f8380e62e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #7 0x561adc5f19a4 in _start (/validate/mcj-fig2dev/fig2dev/fig2dev+0x6e9a4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /validate/mcj-fig2dev/fig2dev/dev/genpict2e.c:1169 in put_arrow
==2970562==ABORTING

POC

as shown in the attachment

Credit

Han Zheng(NCNIPC of China, Hexhive)
Yin Li, Xiaotong Jiao (NCNIPC of China)

[tkl]

Fixed with commit [6676fe].

[Han Zheng]

Fix Credit:
Han Zheng(NCNIPC of China, Hexhive)
Yin Li, Xiaotong Jiao (NCNIPC of China)