Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

heap-buffer-overflow read in nsvg__parseColorRGB() #241

Open
invd opened this issue Mar 3, 2023 · 0 comments
Open

heap-buffer-overflow read in nsvg__parseColorRGB() #241

invd opened this issue Mar 3, 2023 · 0 comments

Comments

@invd
Copy link

invd commented Mar 3, 2023

See #178 for context and program setup. Reproducible on newest master commit 9da543e.

==21508==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000020 [...]
READ of size 1 at 0x602000000020 thread T0
    #0 0x563f49e09bc1 in nsvg__parseColorRGB /nanosvg/src/nanosvg.h:1268:25
    #1 0x563f49e06e63 in nsvg__parseColor /nanosvg/src/nanosvg.h:1467:10
    #2 0x563f49e03609 in nsvg__parseAttr /nanosvg/src/nanosvg.h:1800:22
    #3 0x563f49df7d78 in nsvg__parseAttribs /nanosvg/src/nanosvg.h:1913:4
    #4 0x563f49de632b in nsvg__startElement /nanosvg/src/nanosvg.h:2769:3
    #5 0x563f49de4422 in nsvg__parseElement /nanosvg/src/nanosvg.h:324:3
    #6 0x563f49de2549 in nsvg__parseXML /nanosvg/src/nanosvg.h:348:4
    #7 0x563f49de45f8 in nsvgParse /nanosvg/src/nanosvg.h:3005:2
    #8 0x563f49deeb63 in nsvgParseFromFile /nanosvg/src/nanosvg.h:3038:10

Reproducer file input:
nanosvg_oob_parseColorRGB

CC @memononen @oehhar .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant