Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-113337

[REG 6.4.3 -> 6.5.0] Integer overflow in qfixed_p.h when rendering SVG image on the minimal plugin

    XMLWordPrintable

Details

    • 7b7a01c26 (dev), 7cc629660 (6.5), 318ea97a6 (6.5.1), 37551376b (tqtc/lts-6.2), 3ef230834 (tqtc/lts-5.15)

    Description

      1. Have a build of Qt configured with "-sanitize undefined"
      2. Build the attached project with it.
        qt-cmake /tmp/report/ && cmake --build .
        
      3. Run the resulting program on the minimal plugin and pass the attached input file.
        ./report /tmp/report/58149.svg -platform minimal
        

        The output will end in something like:

        /home/qtrob/dev/clang-15.0.7/qt-dev_05.02-base_imageformats_svg-fubsan-qt-tiff/qtbase/include/QtGui/6.6.0/QtGui/private/../../../../../../../../src/qt-dev_05.02-base_imageformats_svg/qtbase/src/gui/painting/qfixed_p.h:53:51: runtime error: signed integer overflow: 2147443200 + 70400 cannot be represented in type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/clang-15.0.7/qt-dev_05.02-base_imageformats_svg-fubsan-qt-tiff/qtbase/include/QtGui/6.6.0/QtGui/private/../../../../../../../../src/qt-dev_05.02-base_imageformats_svg/qtbase/src/gui/painting/qfixed_p.h:53:51 in
        

        Google's detailed report contains a stacktrace.

      Google's oss-fuzz found this as issue 58149. They will publish their report on July 17th, the latest. The similar report 52532 is already public.

      Attachments

        1. 58149.svg
          43 kB
        2. CMakeLists.txt
          0.4 kB
        3. main.cpp
          0.4 kB
        4. report.html
          1.78 MB

        Issue Links

          For Gerrit Dashboard: QTBUG-113337
          # Subject Branch Project Status CR V

          Activity

            People

              allan.jensen Allan Sandfeld Jensen
              rlohning Robert Löhning
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes