Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-113337

[REG 6.4.3 -> 6.5.0] Integer overflow in qfixed_p.h when rendering SVG image on the minimal plugin

XMLWordPrintable

    • 7b7a01c26 (dev), 7cc629660 (6.5), 318ea97a6 (6.5.1), 37551376b (tqtc/lts-6.2), 3ef230834 (tqtc/lts-5.15)

      1. Have a build of Qt configured with "-sanitize undefined"
      2. Build the attached project with it.
        qt-cmake /tmp/report/ && cmake --build .
        
      3. Run the resulting program on the minimal plugin and pass the attached input file.
        ./report /tmp/report/58149.svg -platform minimal
        

        The output will end in something like:

        /home/qtrob/dev/clang-15.0.7/qt-dev_05.02-base_imageformats_svg-fubsan-qt-tiff/qtbase/include/QtGui/6.6.0/QtGui/private/../../../../../../../../src/qt-dev_05.02-base_imageformats_svg/qtbase/src/gui/painting/qfixed_p.h:53:51: runtime error: signed integer overflow: 2147443200 + 70400 cannot be represented in type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/clang-15.0.7/qt-dev_05.02-base_imageformats_svg-fubsan-qt-tiff/qtbase/include/QtGui/6.6.0/QtGui/private/../../../../../../../../src/qt-dev_05.02-base_imageformats_svg/qtbase/src/gui/painting/qfixed_p.h:53:51 in
        

        Google's detailed report contains a stacktrace.

      Google's oss-fuzz found this as issue 58149. They will publish their report on July 17th, the latest. The similar report 52532 is already public.

        1. CMakeLists.txt
          0.4 kB
          Robert Löhning
        2. main.cpp
          0.4 kB
          Robert Löhning
        3. 58149.svg
          43 kB
          Robert Löhning
        4. report.html
          1.78 MB
          Robert Löhning
        For Gerrit Dashboard: QTBUG-113337
        # Subject Branch Project Status CR V

            allan.jensen Allan Sandfeld Jensen
            rlohning Robert Löhning
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved:

                There are no open Gerrit changes