Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-120331

rendering svg causes int overflows in blend_vertical_gradient_argb

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • P1: Critical
    • 6.7.1, 6.8.0 FF
    • 6.2.0, dev
    • SVG Support
    • Ubuntu 22.04 LTS
      clang 14.0.0
    • ade33a914 (dev), f02ccd86c (6.7), 2e19ceba5 (dev)

    Description

      1. Have a build of Qt configured with "-sanitize undefined".
      2. Build the attached project with that.
      3. Run the resulting binary with the attached svg file as parameter.
        The sanitizer will show overflows:
        /home/qtrob/dev/src/qt-dev_12.21-base_imageformats_svg/qtbase/src/gui/painting/qdrawhelper.cpp:4993:19: runtime error: 6,4521e+09 is outside the range of representable values of type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/src/qt-dev_12.21-base_imageformats_svg/qtbase/src/gui/painting/qdrawhelper.cpp:4993:19 in 
        /home/qtrob/dev/src/qt-dev_12.21-base_imageformats_svg/qtbase/src/gui/painting/qdrawhelper.cpp:5001:59: runtime error: signed integer overflow: -27763137 * 232 cannot be represented in type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/src/qt-dev_12.21-base_imageformats_svg/qtbase/src/gui/painting/qdrawhelper.cpp:5001:59 in 
        /home/qtrob/dev/src/qt-dev_12.21-base_imageformats_svg/qtbase/src/gui/painting/qdrawhelper.cpp:5001:63: runtime error: signed integer overflow: -2146080488 + -2147483648 cannot be represented in type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/qtrob/dev/src/qt-dev_12.21-base_imageformats_svg/qtbase/src/gui/painting/qdrawhelper.cpp:5001:63 i
        

      Google's oss-fuzz found this as issue 63392. Their report is public. It went to "Verified" state in November but I can still reproduce the issue with Qt's latest sources.

      Attachments

        1. main.cpp
          0.4 kB
        2. CMakeLists.txt
          0.4 kB
        3. 63392.svg
          0.1 kB
        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            vgt Eirik Aavitsland
            rlohning Robert Löhning
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There is 1 open Gerrit change