Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A SEGV fault was discovered in function clip #275

Open
Asteriska001 opened this issue Dec 15, 2022 · 0 comments
Open

A SEGV fault was discovered in function clip #275

Asteriska001 opened this issue Dec 15, 2022 · 0 comments

Comments

@Asteriska001
Copy link

Description

A SEGV fault was discovered in function clip::plotgen::points_draw()

Version

Version 5fca358 (Lastest commit)

Environment

Ubuntu 18.04, 64bit

Reproduce

Command

git clone the Lastest Version firstly.
make
./clip -e a.svg  ./poc

POC file at the bottom of this report.

ASAN Report


AddressSanitizer:DEADLYSIGNAL
=================================================================
==22776==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55ba8321f3ad bp 0x7ffeccc44d00 sp 0x7ffeccc44
750 T0)
==22776==The signal is caused by a READ memory access.
==22776==Hint: address points to the zero page.
    #0 0x55ba8321f3ad in clip::plotgen::points_draw(clip::Context*, clip::PlotConfig*, clip::plotgen::PlotPointsConfig*) (/A
FLplusplus/my_test/clip-master/val/clip+0x2d83ad)
    #1 0x55ba832254a2 in clip::plotgen::points_draw(clip::Context*, clip::PlotConfig*, clip::Expr const*) (/AFLplusplus/my_t
est/clip-master/val/clip+0x2de4a2)
    #2 0x55ba8321e526 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::P
lotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*>(std::__invoke_other, clip::ReturnCod
e (*&)(clip::Context*, clip::PlotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*&&) (/AF
Lplusplus/my_test/clip-master/val/clip+0x2d7526)
    #3 0x55ba8321e225 in std::__invoke_result<clip::ReturnCode (*&)(clip::Context*, clip::PlotConfig*, clip::Expr const*), c
lip::Context*&, clip::PlotConfig*&, clip::Expr const*>::type std::__invoke<clip::ReturnCode (*&)(clip::Context*, clip::PlotC
onfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*>(clip::ReturnCode (*&)(clip::Context*, cl
ip::PlotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-ma
ster/val/clip+0x2d7225)
    #4 0x55ba8321ddf3 in clip::ReturnCode std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholde
r<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>::__call<clip::ReturnCode, clip::Expr const*&&, 0ul, 1ul, 2ul>(
std::tuple<clip::Expr const*&&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/AFLplusplus/my_test/clip-master/val/clip+0x2d6df3)
 #5 0x55ba8321d9b8 in clip::ReturnCode std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholde
r<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>::operator()<clip::Expr const*, clip::ReturnCode>(clip::Expr co
nst*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d69b8)
    #6 0x55ba8321d302 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*
, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>(std:
:__invoke_other, std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, cl
ip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d6302)
    #7 0x55ba8321cd99 in std::enable_if<is_invocable_r_v<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*, cl
ip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>, clip::R
eturnCode>::type std::__invoke_r<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_P
laceholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>(std::_Bind<clip::ReturnCode (*(c
lip::Context*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr
 const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d5d99)
    #8 0x55ba8321c756 in std::_Function_handler<clip::ReturnCode (clip::Expr const*), std::_Bind<clip::ReturnCode (*(clip::C
ontext*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)> >::_M_invoke(std::
_Any_data const&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d5756)
    #9 0x55ba83276ee1 in std::function<clip::ReturnCode (clip::Expr const*)>::operator()(clip::Expr const*) const (/AFLplusp
lus/my_test/clip-master/val/clip+0x32fee1)
    #10 0x55ba83274472 in clip::expr_walk_map(clip::Expr const*, std::unique_ptr<clip::Expr, std::function<void (clip::Expr*
)> >*, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::function<cli
p::ReturnCode (clip::Expr const*)>, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> 
> >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pa
ir<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::function<clip::ReturnCode (cl
ip::Expr const*)> > > > const&) (/AFLplusplus/my_test/clip-master/val/clip+0x32d472)
    #11 0x55ba83217326 in clip::plot_draw(clip::Context*, clip::PlotConfig*, clip::Expr const*) (/AFLplusplus/my_test/clip-m
aster/val/clip+0x2d0326)
    #12 0x55ba832184da in clip::plot_eval(clip::Context*, clip::Expr const*) (/AFLplusplus/my_test/clip-master/val/clip+0x2d
14da)
#13 0x55ba830be8a4 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::
Expr const*), clip::Context*, clip::Expr const*>(std::__invoke_other, clip::ReturnCode (*&)(clip::Context*, clip::Expr const
*), clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x1778a4)
    #14 0x55ba830bdf33 in std::enable_if<is_invocable_r_v<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::Expr
 const*), clip::Context*, clip::Expr const*>, clip::ReturnCode>::type std::__invoke_r<clip::ReturnCode, clip::ReturnCode (*&
)(clip::Context*, clip::Expr const*), clip::Context*, clip::Expr const*>(clip::ReturnCode (*&)(clip::Context*, clip::Expr co
nst*), clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x176f33)
    #15 0x55ba830bd45a in std::_Function_handler<clip::ReturnCode (clip::Context*, clip::Expr const*), clip::ReturnCode (*)(
clip::Context*, clip::Expr const*)>::_M_invoke(std::_Any_data const&, clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/m
y_test/clip-master/val/clip+0x17645a)
    #16 0x55ba830bd2a2 in std::function<clip::ReturnCode (clip::Context*, clip::Expr const*)>::operator()(clip::Context*, cl
ip::Expr const*) const (/AFLplusplus/my_test/clip-master/val/clip+0x1762a2)
    #17 0x55ba830bb573 in clip::eval(clip::Context*, clip::Expr const*) (/AFLplusplus/my_test/clip-master/val/clip+0x174573)
    #18 0x55ba830bbc87 in clip::eval(clip::Context*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator
<char> > const&) (/AFLplusplus/my_test/clip-master/val/clip+0x174c87)
    #19 0x55ba82fce30a in main (/AFLplusplus/my_test/clip-master/val/clip+0x8730a)
    #20 0x7f029f382082 in __libc_start_main ../csu/libc-start.c:308
    #21 0x55ba82fcc9fd in _start (/AFLplusplus/my_test/clip-master/val/clip+0x859fd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/AFLplusplus/my_test/clip-master/val/clip+0x2d83ad) in clip::plotgen::points_draw(clip::Con
text*, clip::PlotConfig*, clip::plotgen::PlotPointsConfig*)
==22776==ABORTING

POC

id_000019,sig_11,src_001371,time_37764456,op_havoc,rep_2.zip

Any issue plz contact with me:
[email protected]
OR:
twitter: @Asteriska8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant