Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A SEGV fault was discovered in clip #273

Open
Asteriska001 opened this issue Dec 15, 2022 · 0 comments
Open

A SEGV fault was discovered in clip #273

Asteriska001 opened this issue Dec 15, 2022 · 0 comments

Comments

@Asteriska001
Copy link

Description

A SEGV fault was discovered in function clip::plotgen::vectors_draw()

Version

Version 5fca358 (Lastest commit)

Environment

Ubuntu 18.04, 64bit

Reproduce

Command

git clone the Lastest Version firstly.
make
./clip -e a.svg  ./poc

POC file at the bottom of this report.

ASAN Report

=================================================================
==1292==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5638486da40a bp 0x7ffda770bdc0 sp 0x7ffda770b9
20 T0)
==1292==The signal is caused by a READ memory access.
==1292==Hint: address points to the zero page.
    #0 0x5638486da40a in clip::plotgen::vectors_draw(clip::Context*, clip::PlotConfig*, clip::plotgen::PlotVectorsConfig*) (
/AFLplusplus/my_test/clip-master/val/clip+0x2ef40a)
    #1 0x5638486df50d in clip::plotgen::vectors_draw(clip::Context*, clip::PlotConfig*, clip::Expr const*) (/AFLplusplus/my_
test/clip-master/val/clip+0x2f450d)
    #2 0x5638486c2526 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::P
lotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*>(std::__invoke_other, clip::ReturnCod
e (*&)(clip::Context*, clip::PlotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*&&) (/AF
Lplusplus/my_test/clip-master/val/clip+0x2d7526)
    #3 0x5638486c2225 in std::__invoke_result<clip::ReturnCode (*&)(clip::Context*, clip::PlotConfig*, clip::Expr const*), c
lip::Context*&, clip::PlotConfig*&, clip::Expr const*>::type std::__invoke<clip::ReturnCode (*&)(clip::Context*, clip::PlotC
onfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*>(clip::ReturnCode (*&)(clip::Context*, cl
ip::PlotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-ma
ster/val/clip+0x2d7225)
    #4 0x5638486c1df3 in clip::ReturnCode std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholde
r<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>::__call<clip::ReturnCode, clip::Expr const*&&, 0ul, 1ul, 2ul>(
std::tuple<clip::Expr const*&&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/AFLplusplus/my_test/clip-master/val/clip+0x2d6df3)
    #5 0x5638486c19b8 in clip::ReturnCode std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholde
r<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>::operator()<clip::Expr const*, clip::ReturnCode>(clip::Expr co
nst*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d69b8)
#6 0x5638486c1302 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*
, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>(std:
:__invoke_other, std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, cl
ip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d6302)
    #7 0x5638486c0d99 in std::enable_if<is_invocable_r_v<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*, cl
ip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>, clip::R
eturnCode>::type std::__invoke_r<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_P
laceholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>(std::_Bind<clip::ReturnCode (*(c
lip::Context*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr
 const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d5d99)
    #8 0x5638486c0756 in std::_Function_handler<clip::ReturnCode (clip::Expr const*), std::_Bind<clip::ReturnCode (*(clip::C
ontext*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)> >::_M_invoke(std::
_Any_data const&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d5756)
    #9 0x56384871aee1 in std::function<clip::ReturnCode (clip::Expr const*)>::operator()(clip::Expr const*) const (/AFLplusp
lus/my_test/clip-master/val/clip+0x32fee1)
 #10 0x563848718472 in clip::expr_walk_map(clip::Expr const*, std::unique_ptr<clip::Expr, std::function<void (clip::Expr*
)> >*, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::function<cli
p::ReturnCode (clip::Expr const*)>, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> 
> >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pa
ir<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::function<clip::ReturnCode (cl
ip::Expr const*)> > > > const&) (/AFLplusplus/my_test/clip-master/val/clip+0x32d472)
    #11 0x5638486bb326 in clip::plot_draw(clip::Context*, clip::PlotConfig*, clip::Expr const*) (/AFLplusplus/my_test/clip-m
aster/val/clip+0x2d0326)
    #12 0x5638486bc4da in clip::plot_eval(clip::Context*, clip::Expr const*) (/AFLplusplus/my_test/clip-master/val/clip+0x2d
14da)
    #13 0x5638485628a4 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::
Expr const*), clip::Context*, clip::Expr const*>(std::__invoke_other, clip::ReturnCode (*&)(clip::Context*, clip::Expr const
*), clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x1778a4)
    #14 0x563848561f33 in std::enable_if<is_invocable_r_v<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::Expr
 const*), clip::Context*, clip::Expr const*>, clip::ReturnCode>::type std::__invoke_r<clip::ReturnCode, clip::ReturnCode (*&
)(clip::Context*, clip::Expr const*), clip::Context*, clip::Expr const*>(clip::ReturnCode (*&)(clip::Context*, clip::Expr co
nst*), clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x176f33)
    #15 0x56384856145a in std::_Function_handler<clip::ReturnCode (clip::Context*, clip::Expr const*), clip::ReturnCode (*)(
clip::Context*, clip::Expr const*)>::_M_invoke(std::_Any_data const&, clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/m
y_test/clip-master/val/clip+0x17645a)
    #16 0x5638485612a2 in std::function<clip::ReturnCode (clip::Context*, clip::Expr const*)>::operator()(clip::Context*, cl
ip::Expr const*) const (/AFLplusplus/my_test/clip-master/val/clip+0x1762a2)
    #17 0x56384855f573 in clip::eval(clip::Context*, clip::Expr const*) (/AFLplusplus/my_test/clip-master/val/clip+0x174573)
    #18 0x56384855fc87 in clip::eval(clip::Context*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator
<char> > const&) (/AFLplusplus/my_test/clip-master/val/clip+0x174c87)
    #19 0x56384847230a in main (/AFLplusplus/my_test/clip-master/val/clip+0x8730a)
    #20 0x7f86bed29082 in __libc_start_main ../csu/libc-start.c:308
    #21 0x5638484709fd in _start (/AFLplusplus/my_test/clip-master/val/clip+0x859fd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/AFLplusplus/my_test/clip-master/val/clip+0x2ef40a) in clip::plotgen::vectors_draw(clip::Co
ntext*, clip::PlotConfig*, clip::plotgen::PlotVectorsConfig*)
==1292==ABORTING

POC

id_000000,sig_11,src_000835,time_7526805,op_havoc,rep_4.zip

Any issue plz contact with me:
[email protected]
OR:
twitter: @Asteriska8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant