1459757 - graphite2: crash at null in [@ graphite2::Segment::delLineEnd]

Status: NEW

(Core :: Graphics: Text, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.fuzz

Found with graphite commit edeb6b92d93aca07df457d81a1d728a799a54350

==9994==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052a905 bp 0x7ffc5b49e810 sp 0x7ffc5b49e6c0 T0)
==9994==The signal is caused by a WRITE memory access.
==9994==Hint: address points to the zero page.
    #0 0x52a904 in graphite2::Slot::next(graphite2::Slot*) src/inc/Slot.h:85:33
    #1 0x52a904 in graphite2::Segment::delLineEnd(graphite2::Slot*) src/Justifier.cpp:274
    #2 0x52a904 in graphite2::Segment::justify(graphite2::Slot*, graphite2::Font const*, float, graphite2::justFlags, graphite2::Slot*, graphite2::Slot*) src/Justifier.cpp:228
    #3 0x511303 in LLVMFuzzerTestOneInput tests/fuzz-tests/gr-fuzzer-segment.cpp:115:9
    #4 0x511a24 in main tests/fuzz-tests/gr-fuzzer-segment.cpp:143:7
    #5 0x7f0405a5182f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #6 0x41a3e8 in _start (gr-fuzzer-segment+0x41a3e8)

Comment 1

[martin_hosken]

what command line did you use to exercise this?

Comment 2

[Tyson Smith [:tsmith]]

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1459753#c2

Comment 3

[Stacy Markel]

I had the same kind of problem too. I got so many crashes in lower version of windows in higher version of Windows it works correctly. For the troubleshoot or correction of such kind of errors Visit https://www.delltechsupportnumbers.com/blog/fix-dell-error-code-0xc0000001/