Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-125065

[REG 6.5.3 -> 6.6.0] Null-pointer deref when loading svg file

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • P1: Critical
    • 6.7.2, 6.8.0 FF
    • 6.6.0, 6.8
    • SVG Support
    • Ubuntu 22.04 LTS
      clang 14.0.0
    • e47bbb0c8 (dev), 36f297060 (6.7), 7533b621e (dev)

    Description

      1. Have a build of Qt including qtsvg.
        No sanitizers needed.
      2. Build the attached project:
        qt-cmake /tmp/report/ && cmake --build .
        
      3. Run the resulting binary passing the attached input file as parameter:
        ./report /tmp/report/61586.svg
        

        The program crashes when dereferencing a null pointer:

        1  QHash<QString, QSvgRefCounter<QSvgFont>>::valueImpl<QString, QHash<QString, QSvgRefCounter<QSvgFont>>::value(QString const&) const::{lambda()#1}>(QString const&, QHash<QString, QSvgRefCounter<QSvgFont>>::value(QString const&) const::{lambda()#1}&&) const qhash.h              1046 0x7ffff7f7afcf 
        2  QHash<QString, QSvgRefCounter<QSvgFont>>::value                                                                                                                                                                                                                qhash.h              1056 0x7ffff7f7af6d 
        3  QHash<QString, QSvgRefCounter<QSvgFont>>::operator[]                                                                                                                                                                                                           qhash.h              1083 0x7ffff7f77daf 
        4  QSvgTinyDocument::svgFont                                                                                                                                                                                                                                      qsvgtinydocument.cpp 363  0x7ffff7f769ad 
        5  parseFont                                                                                                                                                                                                                                                      qsvghandler.cpp      1353 0x7ffff7f114f3 
        6  parseStyle                                                                                                                                                                                                                                                     qsvghandler.cpp      2386 0x7ffff7f0fc08 
        7  parseStyle                                                                                                                                                                                                                                                     qsvghandler.cpp      2429 0x7ffff7f05896 
        8  cssStyleLookup                                                                                                                                                                                                                                                 qsvghandler.cpp      2071 0x7ffff7f0f60d 
        9  parseStopNode                                                                                                                                                                                                                                                  qsvghandler.cpp      3879 0x7ffff7f22823 
        10 QSvgHandler::startElement                                                                                                                                                                                                                                      qsvghandler.cpp      4776 0x7ffff7f02b98 
        11 QSvgHandler::parse                                                                                                                                                                                                                                             qsvghandler.cpp      4571 0x7ffff7f00ef3 
        12 QSvgHandler::init                                                                                                                                                                                                                                              qsvghandler.cpp      4471 0x7ffff7f00b24 
        13 QSvgHandler::QSvgHandler                                                                                                                                                                                                                                       qsvghandler.cpp      4444 0x7ffff7f00a24 
        14 QSvgTinyDocument::load                                                                                                                                                                                                                                         qsvgtinydocument.cpp 214  0x7ffff7f75427 
        15 loadDocument<QByteArray>                                                                                                                                                                                                                                       qsvgrenderer.cpp     400  0x7ffff7f5391a 
        16 QSvgRenderer::load                                                                                                                                                                                                                                             qsvgrenderer.cpp     430  0x7ffff7f52f04 
        17 QSvgRenderer::QSvgRenderer                                                                                                                                                                                                                                     qsvgrenderer.cpp     146  0x7ffff7f52eb6 
        18 main                                                                                                                                                                                                                                                           main.cpp             13   0x555555555354 
        

      Google's oss-fuzz found this as issue 61586.

      Attachments

        1. 61586.svg
          0.0 kB
          Robert Löhning
        2. CMakeLists.txt
          0.4 kB
          Robert Löhning
        3. main.cpp
          0.4 kB
          Robert Löhning
        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            qt.team.graphics.and.multimedia Qt Graphics Team
            rlohning Robert Löhning
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes