[Text Mode] NULL pointer dereference in SVGNative::SVGDocument::Render
xinali opened this issue · 2 comments
xinali commented
Compile Options
ubuntu 16.04 x64
clang++-6.0
ASAN
Debug
pwndbg> r poc_file_4
Starting program: /home/tmp/svg-native-viewer/svgnative/Build/linux/example/testText/test poc_file_4
Program received signal SIGSEGV, Segmentation fault.
SVGNative::SVGDocument::Render (this=0x0) at /home/tmp/svg-native-viewer/svgnative/src/SVGDocument.cpp:59
59 mDocument->Render(colorMap, mDocument->mViewBox[2], mDocument->mViewBox[3]);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────────────────[ REGISTERS ]────────────────────────────────────────────────────────
RAX 0x7fffffffc0f8 ◂— 0x0
RBX 0x6d4c70 —▸ 0x4aee48 —▸ 0x407f10 ◂— lea rsp, [rsp - 0x98]
RCX 0x951bb0bf
RDX 0x951b8a7c
RDI 0x0
RSI 0x5ad33ebe
R8 0x6d5780 —▸ 0x6d400f ◂— 0x726f66736e617274 ('transfor')
R9 0x1
R10 0x126f
R11 0x7ffff7ae1490 (__cxa_free_exception) ◂— mov rax, qword ptr [rip + 0x2f1899]
R12 0x7fffffffcd80 ◂— 0x9509119d
R13 0x7fffffffc160 ◂— 0xe40
R14 0x7fffffffc3c8 —▸ 0x6d4c70 —▸ 0x4aee48 —▸ 0x407f10 ◂— lea rsp, [rsp - 0x98]
R15 0x7fffffffc150 —▸ 0x6d3d00 ◂— '<svg xmlns'
RBP 0x7fffffffc400 ◂— 'test-green'
RSP 0x7fffffffc0f0 —▸ 0x6d4c80 —▸ 0x4b00c8 —▸ 0x41bf30 (SVGNative::StringSVGRenderer::~StringSVGRenderer()) ◂— lea rsp, [rsp - 0x98]
RIP 0x4092f2 (SVGNative::SVGDocument::Render()+98) ◂— mov rdi, qword ptr [rdi]
─────────────────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────────────────
► 0x4092f2 <SVGNative::SVGDocument::Render()+98> mov rdi, qword ptr [rdi]
0x4092f5 <SVGNative::SVGDocument::Render()+101> movss xmm0, dword ptr [rdi + 0x10090]
0x4092fd <SVGNative::SVGDocument::Render()+109> movss xmm1, dword ptr [rdi + 0x10094]
0x409305 <SVGNative::SVGDocument::Render()+117> mov rsi, rsp
0x409308 <SVGNative::SVGDocument::Render()+120> call 0x45b5f0
0x40930d <SVGNative::SVGDocument::Render()+125> mov rsi, qword ptr [rsp + 0x10]
0x409312 <SVGNative::SVGDocument::Render()+130> mov rdi, rsp
0x409315 <SVGNative::SVGDocument::Render()+133> call 0x4069b0
0x40931a <SVGNative::SVGDocument::Render()+138> add rsp, 0x30
0x40931e <SVGNative::SVGDocument::Render()+142> pop rbx
0x40931f <SVGNative::SVGDocument::Render()+143> ret
──────────────────────────────────────────────────────[ SOURCE (CODE) ]──────────────────────────────────────────────────────
In file: /home/tmp/svg-native-viewer/svgnative/src/SVGDocument.cpp
54 SVGDocument::~SVGDocument() {}
55
56 void SVGDocument::Render()
57 {
58 ColorMap colorMap;
► 59 mDocument->Render(colorMap, mDocument->mViewBox[2], mDocument->mViewBox[3]);
60 }
61
62 void SVGDocument::Render(float width, float height)
63 {
64 ColorMap colorMap;
──────────────────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffc0f0 —▸ 0x6d4c80 —▸ 0x4b00c8 —▸ 0x41bf30 (SVGNative::StringSVGRenderer::~StringSVGRenderer()) ◂— lea rsp, [rsp - 0x98]
01:0008│ rax 0x7fffffffc0f8 ◂— 0x0
... ↓
03:0018│ 0x7fffffffc108 —▸ 0x7fffffffc0f8 ◂— 0x0
... ↓
05:0028│ 0x7fffffffc118 ◂— 0x0
06:0030│ 0x7fffffffc120 —▸ 0x6d4c70 —▸ 0x4aee48 —▸ 0x407f10 ◂— lea rsp, [rsp - 0x98]
07:0038│ 0x7fffffffc128 —▸ 0x403bad (main+5213) ◂— nop dword ptr [rax]
────────────────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────────────────
► f 0 4092f2 SVGNative::SVGDocument::Render()+98
f 1 403bad main+5213
f 2 7ffff718c830 __libc_start_main+240
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Program received signal SIGSEGV (fault address 0x0)
pwndbg> p mDocument
Cannot access memory at address 0x0
mpsuzuki commented