Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dereference near-null pointer in formUpdateBuffer #35

Closed
kcwu opened this issue Nov 7, 2016 · 1 comment
Closed

dereference near-null pointer in formUpdateBuffer #35

kcwu opened this issue Nov 7, 2016 · 1 comment

Comments

@kcwu
Copy link
Contributor

kcwu commented Nov 7, 2016

input

00000000: 3c74 6162 6c65 3e30 3c6e 6f62 722f 3c3e  <table>0<nobr/<>
00000010: 303c 786d 703e 3c69 6e74 6572 6e61 6c3e  0<xmp><internal>
00000020: 3c73 656c 6563 7420 6d75 6c74 6970 6c65  <select multiple
00000030: 3e3c 6f70 7469 6f6e 3e                   ><option>

gdb --args ./w3m -T text/html -dump file

Program received signal SIGSEGV, Segmentation fault.
0x000000000044f741 in formUpdateBuffer (a=0x7e1000, buf=0x7d4e00, form=0x7e0f80) at form.c:445
445             if (spos >= buf->currentLine->len || spos < 0)
(gdb) p buf
$1 = (Buffer *) 0x7d4e00
(gdb) p buf->currentLine
$2 = (Line *) 0x0
(gdb) bt
#0  0x000000000044f741 in formUpdateBuffer (a=0x7e1000, buf=0x7d4e00, form=0x7e0f80) at form.c:445
#1  0x000000000044f04c in formResetBuffer (buf=0x7d4e00, formitem=0x7db500) at form.c:272
#2  0x000000000042c9cc in loadHTMLBuffer (f=0x7fffffffca80, newBuf=0x7d4e00) at file.c:6781
#3  0x0000000000416ae0 in loadSomething (f=0x7fffffffca80, loadproc=0x42c85e <loadHTMLBuffer>, defaultbuf=0x7d4e00) at file.c:224
#4  0x000000000041c952 in loadGeneralFile (path=0x7c4b00 "min/32", current=0x0, referer=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>, flag=0, request=0x0) at file.c:2241
#5  0x0000000000407171 in main (argc=5, argv=0x7fffffffcda8, envp=0x7fffffffcdd8) at main.c:1020

found by afl-fuzz

tats added a commit that referenced this issue Nov 7, 2016
@tats
Copy link
Owner

tats commented Nov 7, 2016

Fixed, thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants