[cairo-bugs] [Bug 101527] New: NULL pointer dereference in cairo-bentley-ottmann-rectangular.c:558

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=101527

            Bug ID: 101527
           Summary: NULL pointer dereference in
                    cairo-bentley-ottmann-rectangular.c:558
           Product: cairo
           Version: unspecified
          Hardware: Other
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: general
          Assignee: chris at chris-wilson.co.uk
          Reporter: foca at salesforce.com
        QA Contact: cairo-bugs at cairographics.org

Created attachment 132097
  --> https://bugs.freedesktop.org/attachment.cgi?id=132097&action=edit
Proof of concept

There is a NULL pointer dereference in cairo-bentley-ottmann-rectangular.c:558
in the function sweep_line_delete_edge:

543     sweep_line_delete_edge (sweep_line_t *sweep, edge_t *edge)
544     {
545         if (edge->right != NULL) {
546             edge_t *next = edge->next;
547             if (next->x == edge->x) {
548                 next->top = edge->top;
549                 next->right = edge->right;
550             } else
551                 edge_end_box (sweep, edge, sweep->current_y);
552         }
553     
554         if (sweep->cursor == edge)
555             sweep->cursor = edge->prev;
556     
557         edge->prev->next = edge->next;
558         edge->next->prev = edge->prev;

edge->next is 0 at line 558 so 0->prev is a NULL pointer dereference of 0x8
because ->prev is at +8 in edge struct, the segfault occurs at address 0x8.

I don't know exactly why the ->next field is NULL, I guess a solution could be
to check for this condition at the beginning of the function.

This bug was found when using a poppler util, pdftocairo. A PoC is attached. To
reproduce the bug use:
pdftocairo -svg PoC.pdf

This vulnerability has been found by Offensive Research at Salesforce.com:
Alberto Garcia (@algillera), Francisco Oca (@francisco_oca) & Suleman Ali
(@Salbei_)

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.cairographics.org/archives/cairo-bugs/attachments/20170620/5aeb5322/attachment.html>