NanoMichael / MicroTeX

A dynamic, cross-platform, and embeddable LaTeX rendering library
MIT License
399 stars 66 forks source link

Another large set of fuzzer fixes #163

Closed sp1ritCS closed 9 months ago

sp1ritCS commented 10 months ago

The following subset of minified crashlogs was used:

---
\begin{array}{{{}}}\resizebox0{
---
\sfrac$
---
\underbrace\newcolumntype
---
\begin{array}|\stackinset{}{}{}{
---
\accentset
---

\st\newcolumntype
---
\begin{split}\rotatebox{{{
---
\sideset$
---

There are a few crashes that contain microtex::ArrayFormula::insertAtomIntoCol in their Stacktrace, that end up crashing in libstdc++ std::__shared_ptr<microtex::Atom, (__gnu_cxx::_Lock_policy)2>::__shared_ptr function. I have yet to figure out what exactly causes this, as this appears to be in the end also a nullptr deref, however no nullptr is ever passed into sptr. For example, \begin{cases}&{}\\\\ causes this, any ideas?

sp1ritCS commented 9 months ago

@NanoMichael any idea about the mentioned issue with insertAtomIntoCol?