<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_RESOLVED bz_closed" title="RESOLVED INVALID - CVE-2014-5116: large string null pointer dereference in cairo_image_surface_get_data" href="https://bugs.freedesktop.org/show_bug.cgi?id=82431#c6">Comment # 6</a> on <a class="bz_bug_link bz_status_RESOLVED bz_closed" title="RESOLVED INVALID - CVE-2014-5116: large string null pointer dereference in cairo_image_surface_get_data" href="https://bugs.freedesktop.org/show_bug.cgi?id=82431">bug 82431</a> from <a class="email" href="mailto:siddharths@fedoraproject.org" title="Siddharth <siddharths@fedoraproject.org>"> Siddharth</a> <pre>I dont think this is a cairo bug, seems to be copy pasted what was in the crash report. Did some analysis found this following code in simple_dialog.c , causes crash the argument ap is va_list (Variable Argument Lists) which is used when a function can accept any number of values, the number of arguments are unkown at compile time. putting 50,000 "A" s causes the corruption in va_list which lead to crash of program while executing the code message = g_strdup_vprintf(msg_format, ap); $17 = {_flags = 219, _IO_read_ptr = 0x7fc291d9f30e "g_strdup_vprintf", _IO_read_end = 0x7fc291d89188 "", _IO_read_base = 0x0, _IO_write_base = 0x0, _IO_write_ptr = 0x7fc291d86b38 "", _IO_write_end = 0x7fc291d9d829 "report_failure", _IO_buf_base = 0x7fc28dbc61f8 "", _IO_buf_end = 0x7fc291d8f2d0 "\251\024", _IO_save_base = 0x500000000 <Address 0x500000000 out of bounds>, _IO_backup_base = 0x100000315 <Address 0x100000315 out of bounds>, _IO_save_end = 0x20 <Address 0x20 out of bounds>, _markers = 0x7fc28b541e80, _chain = 0x7fc291d894e0, _fileno = -1950316992, _flags2 = 32706, _old_offset = 140473647167928, _cur_column = 37256, _vtable_offset = -40 '\330', _shortbuf = "\221", _lock = 0x0, _offset = 3562113576, _codecvt = 0x5, _wide_data = 0x4512f0, _freeres_list = 0x0, _freeres_buf = 0x7fc2947ba9f0, _freeres_size = 140473670547440, _mode = -1848074240, _unused2 = "\302\177\000\000\360_\267\221\302\177\000\000\005\000\000\000\000\000\000"} Submitting 50,000 A's into the the filter text box causes corruption scrambling the text on the Wireshark GUI this is because the va_list which stores all the strings are corrupted.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>