Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-125065

[REG 6.5.3 -> 6.6.0] Null-pointer deref when loading svg file

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • P1: Critical
    • 6.7.2, 6.8.0 FF
    • 6.6.0, 6.8
    • SVG Support
    • Ubuntu 22.04 LTS
      clang 14.0.0
    • e47bbb0c8 (dev), 36f297060 (6.7), 7533b621e (dev)

    Description

      1. Have a build of Qt including qtsvg.
        No sanitizers needed.
      2. Build the attached project:
        qt-cmake /tmp/report/ && cmake --build .
        
      3. Run the resulting binary passing the attached input file as parameter:
        ./report /tmp/report/61586.svg
        

        The program crashes when dereferencing a null pointer:

        1  QHash<QString, QSvgRefCounter<QSvgFont>>::valueImpl<QString, QHash<QString, QSvgRefCounter<QSvgFont>>::value(QString const&) const::{lambda()#1}>(QString const&, QHash<QString, QSvgRefCounter<QSvgFont>>::value(QString const&) const::{lambda()#1}&&) const qhash.h              1046 0x7ffff7f7afcf 
        2  QHash<QString, QSvgRefCounter<QSvgFont>>::value                                                                                                                                                                                                                qhash.h              1056 0x7ffff7f7af6d 
        3  QHash<QString, QSvgRefCounter<QSvgFont>>::operator[]                                                                                                                                                                                                           qhash.h              1083 0x7ffff7f77daf 
        4  QSvgTinyDocument::svgFont                                                                                                                                                                                                                                      qsvgtinydocument.cpp 363  0x7ffff7f769ad 
        5  parseFont                                                                                                                                                                                                                                                      qsvghandler.cpp      1353 0x7ffff7f114f3 
        6  parseStyle                                                                                                                                                                                                                                                     qsvghandler.cpp      2386 0x7ffff7f0fc08 
        7  parseStyle                                                                                                                                                                                                                                                     qsvghandler.cpp      2429 0x7ffff7f05896 
        8  cssStyleLookup                                                                                                                                                                                                                                                 qsvghandler.cpp      2071 0x7ffff7f0f60d 
        9  parseStopNode                                                                                                                                                                                                                                                  qsvghandler.cpp      3879 0x7ffff7f22823 
        10 QSvgHandler::startElement                                                                                                                                                                                                                                      qsvghandler.cpp      4776 0x7ffff7f02b98 
        11 QSvgHandler::parse                                                                                                                                                                                                                                             qsvghandler.cpp      4571 0x7ffff7f00ef3 
        12 QSvgHandler::init                                                                                                                                                                                                                                              qsvghandler.cpp      4471 0x7ffff7f00b24 
        13 QSvgHandler::QSvgHandler                                                                                                                                                                                                                                       qsvghandler.cpp      4444 0x7ffff7f00a24 
        14 QSvgTinyDocument::load                                                                                                                                                                                                                                         qsvgtinydocument.cpp 214  0x7ffff7f75427 
        15 loadDocument<QByteArray>                                                                                                                                                                                                                                       qsvgrenderer.cpp     400  0x7ffff7f5391a 
        16 QSvgRenderer::load                                                                                                                                                                                                                                             qsvgrenderer.cpp     430  0x7ffff7f52f04 
        17 QSvgRenderer::QSvgRenderer                                                                                                                                                                                                                                     qsvgrenderer.cpp     146  0x7ffff7f52eb6 
        18 main                                                                                                                                                                                                                                                           main.cpp             13   0x555555555354 
        

      Google's oss-fuzz found this as issue 61586.

      Attachments

        1. 61586.svg
          0.0 kB
        2. CMakeLists.txt
          0.4 kB
        3. main.cpp
          0.4 kB
        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            qt.team.graphics.and.multimedia Qt Graphics Team
            rlohning Robert Löhning
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes