SIGSEGV on specific animation

[hummelchen]

Hello.

Today I've encountered Telegram client crash on specific sticker and attempted to trace down the issue.
This crash was caused by rlottie library. Attempt to render sticker attached results in segmentation violation.
After some experiments I managed to reproduce this bug using the latest lottie2gif utility (ad9beae).

PoC:

% ./example/lottie2gif sticker.json
AddressSanitizer:DEADLYSIGNAL
=================================================================
==53907==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f80866bf91f bp 0x7ffd5eb50b80 sp 0x7ffd5eb50af0 T0)
==53907==The signal is caused by a READ memory access.
==53907==Hint: address points to the zero page.
    #0 0x7f80866bf91e in operator-(VPointF const&, VPointF const&) /home/user/projects/lottie/rlottie/rlottie/src/vector/vpoint.h:67

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/user/projects/lottie/rlottie/rlottie/src/vector/vpoint.h:67 in operator-(VPointF const&, VPointF const&)
==53907==ABORTING

Full backtrace:

#0  0x0000555555583ab1 in operator- (p1=..., p2=...) at /home/user/projects/lottie/rlottie/rlottie/src/vector/vpoint.h:67
#1  0x000055555558f08f in rlottie::internal::model::PathData::lerp (start=..., end=..., t=<optimized out>, result=...) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottiemodel.h:120
#2  0x000055555558fd3f in rlottie::internal::model::Property<rlottie::internal::model::PathData, void>::value<rlottie::internal::model::PathData> (this=<optimized out>, frameNo=<optimized out>, path=...) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottiemodel.h:217
#3  0x0000555555572969 in rlottie::internal::renderer::Shape::update (this=0x626000004628, frameNo=227, flag=...) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.cpp:1072
#4  0x0000555555575528 in rlottie::internal::renderer::Group::update (this=0x6260000044a8, frameNo=<optimized out>, parentMatrix=..., parentAlpha=<optimized out>, flag=...) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.h:384
#5  0x0000555555575528 in rlottie::internal::renderer::Group::update (this=0x626000003e80, frameNo=<optimized out>, parentMatrix=..., parentAlpha=<optimized out>, flag=...) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.h:384
#6  0x0000555555574635 in rlottie::internal::renderer::ShapeLayer::updateContent (this=0x626000003df8) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.h:249
#7  0x000055555558316a in rlottie::internal::renderer::Layer::update (this=0x626000003df8, frameNumber=<optimized out>, parentMatrix=..., parentAlpha=<optimized out>) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.cpp:430
#8  0x00005555555800f0 in rlottie::internal::renderer::CompLayer::updateContent (this=0x61d000001518) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.h:248
#9  0x000055555558316a in rlottie::internal::renderer::Layer::update (this=0x61d000001518, frameNumber=<optimized out>, parentMatrix=..., parentAlpha=<optimized out>) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.cpp:430
#10 0x00005555555800f0 in rlottie::internal::renderer::CompLayer::updateContent (this=0x61d000001490) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.h:248
#11 0x000055555558316a in rlottie::internal::renderer::Layer::update (this=0x61d000001490, frameNumber=<optimized out>, parentMatrix=..., parentAlpha=<optimized out>) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.cpp:430
#12 0x0000555555570466 in rlottie::internal::renderer::Composition::update (this=0x60e000002500, frameNo=120, size=..., keepAspectRatio=<optimized out>) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieitem.cpp:146
#13 0x0000555555563fda in AnimationImpl::update (this=this@entry=0x6060000050c0, frameNo=<optimized out>, size=..., keepAspectRatio=<optimized out>) at /usr/include/c++/9/bits/unique_ptr.h:360
#14 0x000055555556422b in AnimationImpl::render (keepAspectRatio=<optimized out>, surface=..., frameNo=<optimized out>, this=<optimized out>) at /home/user/projects/lottie/rlottie/rlottie/src/vector/vpoint.h:165
#15 AnimationImpl::render (this=0x6060000050c0, frameNo=<optimized out>, surface=..., keepAspectRatio=<optimized out>) at /home/user/projects/lottie/rlottie/rlottie/src/lottie/lottieanimation.cpp:108
#16 0x0000555555564a3e in rlottie::Animation::renderSync (this=0x602000002c70, frameNo=0, surface=..., keepAspectRatio=<optimized out>) at /usr/include/c++/9/bits/unique_ptr.h:360
#17 0x00005555555636ea in App::render (this=0x7fffffffd260, w=<optimized out>, h=<optimized out>) at /usr/include/c++/9/bits/unique_ptr.h:360
#18 0x000055555555e769 in main (argc=argc@entry=2, argv=argv@entry=0x7fffffffd418) at /home/user/projects/lottie/rlottie/rlottie/example/lottie2gif.cpp:175
#19 0x00007ffff704b0b3 in __libc_start_main (main=0x55555555e5c2 <main(int, char**)>, argc=2, argv=0x7fffffffd418, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffd408) at ../csu/libc-start.c:308
#20 0x000055555555f17e in _start () at /home/user/projects/lottie/rlottie/rlottie/example/lottie2gif.cpp:178

[smohantty]

thanks for reporting. looks like the resource contains some animation frame with empty path data. I have pushed a patch which fix the issue #461