Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-100217

[REG 6.2.2 -> 6.2.3] Integer overflow when rendering svg image

    XMLWordPrintable

Details

    • 1749388cdc765fca4206aaf0f84ac9b0877dfc9a d6c4a3edf9 (qt/qtbase/dev) d6c4a3edf9 (qt/tqtc-qtbase/dev) c1d2f4913d (qt/tqtc-qtbase/5.15) 78b3ffc99b (qt/qtbase/6.3) 78b3ffc99b (qt/tqtc-qtbase/6.3) d519901ddb (qt/qtbase/6.2) d519901ddb (qt/tqtc-qtbase/6.2)

    Description

      1. Have a build of Qt including qtsvg configured with "-sanitize undefined".
      2. Use that to build the attached project.
        qt-cmake /tmp/report/ && cmake --build .
        
      3. Run the resulting program and pass the input file.
        ./report /tmp/report/43998.svg
        

        You will see output like:

        /home/qtrob/dev/clang-10.0.0/qt-dev_01.10-base_svg-fubsan/qtbase/include/QtCore/../../../../../src/qt-dev_01.10-base_svg/qtbase/src/corelib/kernel/qmath.h:81:16: runtime error: -nan is outside the range of representable values of type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/clang-10.0.0/qt-dev_01.10-base_svg-fubsan/qtbase/include/QtCore/../../../../../src/qt-dev_01.10-base_svg/qtbase/src/corelib/kernel/qmath.h:81:16 in 
        /home/qtrob/dev/clang-10.0.0/qt-dev_01.10-base_svg-fubsan/qtbase/include/QtCore/../../../../../src/qt-dev_01.10-base_svg/qtbase/src/corelib/kernel/qmath.h:75:16: runtime error: -nan is outside the range of representable values of type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/clang-10.0.0/qt-dev_01.10-base_svg-fubsan/qtbase/include/QtCore/../../../../../src/qt-dev_01.10-base_svg/qtbase/src/corelib/kernel/qmath.h:75:16 in 
        /home/qtrob/dev/src/qt-dev_01.10-base_svg/qtbase/src/corelib/tools/qrect.h:183:46: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/src/qt-dev_01.10-base_svg/qtbase/src/corelib/tools/qrect.h:183:46 in 
        /home/qtrob/dev/src/qt-dev_01.10-base_svg/qtbase/src/corelib/tools/qrect.h:183:70: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/src/qt-dev_01.10-base_svg/qtbase/src/corelib/tools/qrect.h:183:70 in 
        /home/qtrob/dev/src/qt-dev_01.10-base_svg/qtbase/src/gui/kernel/../../corelib/global/qglobal.h:790:14: runtime error: -nan is outside the range of representable values of type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/src/qt-dev_01.10-base_svg/qtbase/src/gui/kernel/../../corelib/global/qglobal.h:790:14 in
        

      Google's oss-fuzz found this as issue 43998. To be precise, that report is about the overflow in qrect.h:183:46. They will publish the report on April 25th.

      Attachments

        1. 43998.svg
          0.2 kB
          Robert Löhning
        2. CMakeLists.txt
          0.3 kB
          Robert Löhning
        3. main.cpp
          0.4 kB
          Robert Löhning
        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            esabraha Eskil Abrahamsen Blomfeldt
            rlohning Robert Löhning
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes