SINTEF-Geometry / SISL

The SINTEF Spline Library
GNU Affero General Public License v3.0
177 stars 60 forks source link

Dereferring nullpointer in s1251 #31

Open christiana opened 4 years ago

christiana commented 4 years ago

In s1251 here, s1710 is called. the return value jstat can be 5:

parameter value at end of curve, rcnew1=SISL_NULL or rcnew2=SISL_NULL.

indicating that qc1 OR qc2 may be NULL. This is not handled by s1251, leading to a nullptr exception here or here in our case.

Our analysis is that in this case we are approaching the resolution limit, but the check for this in s1251 is slightly different from that in s1710. It might be solved by checking for NULL and stop recursion.