Null Pointer Dereference in DVI Font Handling Leads to Segmentation Fault

[wammr]

Summary

A null pointer dereference vulnerability exists in the DVI font handling logic of dvisvgm. When processing malformed or fuzzed DVI files, the program may attempt to access methods of a null Font* pointer, resulting in a segmentation fault and denial of service. This affects all users who process untrusted or malformed DVI files.

Details

The vulnerability is present in two locations:

1. DVIToSVG::dviSetChar0 / dviSetChar
   When these functions are called with a null font pointer, they pass it down to DVIToSVGActions::setChar and eventually to FontManager::addUsedChar, where the null pointer is dereferenced without any check.

   void DVIToSVG::dviSetChar0(uint32_t c, const Font *font) {
       // ... no null check ...
       _actions->setChar(..., *font); // font may be nullptr
   }

2. DVIReader::cmdSetChar / cmdSetChar0
   After obtaining the current font pointer, the code directly calls methods on it without checking for null, leading to a crash if the font is undefined.

   void DVIReader::cmdSetChar(int len) {
       Font *font = FontManager::instance().getFont(_currFontNum);
       // ... no null check ...
       moveRight(font->charWidth(c) * font->scaleFactor() * _mag / 1000.0, MoveMode::SETCHAR);
   }

PoC

1. Compile dvisvgm with default settings.
2. Use a fuzzed or malformed DVI file that triggers the bug.
3. Run: ./dvisvgm crashsample.dvi
4. Observe a segmentation fault.

Impact

• Type: Denial of Service (DoS) via segmentation fault.
• Who is impacted: Any user processing untrusted or malformed DVI files with dvisvgm.

Suggested Fix

Add null pointer checks before dereferencing any Font* pointer in the affected functions. For example:

if (!font)
    return; // or handle error appropriately

Apply this fix in all relevant locations, including DVIToSVG::dviSetChar0, DVIToSVG::dviSetChar, DVIReader::cmdSetChar, and DVIReader::cmdSetChar0.

Attachments

• Crash sample file crashsample.zip

• Crashlog generated by GDB

  crashlog_DVIReader.txt
  crashlog_DVIToSVG.txt

[mgieseki]

Thanks for reporting this issue.