mymedia2
commented
2 years ago Fuzz testing is being in progress, and I found three new JSONs that broke rLottie.
Cases 7, 8
Assertion failures in ft_stroke_border_export and model::Trim::(no)?loop and then stack buffer overflow if the NDEBUG macro is defined.
014f.json {"v":"0","op":5,"h":3,"layers":[{"ty":4,"ks":{},"shapes":[{"ty":"sr","pt":{"k":[{"i":{},"e":[10000]}]},"or":{"k":[{"i":{},"s":[1]},{"t":4}]},"os":{"k":[{"i":{},"s":[5]},{"t":4}]}},{"ty":"st","w":{"k":2}}],"op":5}]}
016f.json {"v":"0","op":9,"layers":[{"ty":4,"ks":{},"shapes":[{"ty":"tm","s":{"k":[{"i":{},"o":{"y":[9]},"s":[1]},{"t":9}]},"o":{"k":5}}],"op":9}]}
Click to see output (lottie2gif ...)
``` mymedia@barberry:~/rlottie$ build/example/lottie2gif fuzz/collect/014f.json lottie2gif: /home/mymedia/rlottie/src/vector/freetype/v_ft_stroker.cpp:666: void ft_stroke_border_export(SW_FT_StrokeBorder, SW_FT_Outline*): Assertion `SW_FT_Outline_Check(outline) == 0' failed. Aborted mymedia@barberry:~/rlottie$ build/example/lottie2gif fuzz/collect/016f.json lottie2gif: /home/mymedia/rlottie/src/lottie/lottiemodel.h:1058: rlottie::internal::model::Trim::Segment rlottie::internal::model::Trim::noloop(float, float) const: Assertion `start >= 0' failed. Aborted ```Case 9
Deadlock due to an unset guard flag in SharedRle.
017f.json {"v":"5.1.17","fr":30,"op":30,"w":300,"h":300,"layers":[{"op":30,"ty":4,"ks":{},"shapes":[{"ty":"rc","s":{"k":[{"i":{},"s":[1,1],"e":[111111]},{"t":3}]}},{"ty":"st","w":{"k":1},"d":[{"v":{"k":1}},{"v":{}}]}]}]}
I did some fuzzing and found six interesting JSONs that cause to crashes or undefined behaviour. It would be great to have them fixed.
Case 1
Valgrid noticed usage of uninitialized values. 001f.json
{"v":"0","op":9,"layers":[{"ddd":0,"ks":{"r":{"k":[{"i":{},"":0}]}},"op":1}]}Click to see output (valgrind ...)
``` mymedia@barberry:~/rlottie$ valgrind --track-origins=yes build/example/lottie2gif fuzz/collect/001f.json ==1821184== Memcheck, a memory error detector ==1821184== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==1821184== Using Valgrind-3.17.0 and LibVEX; rerun with -h for copyright info ==1821184== Command: build/example/lottie2gif fuzz/collect/001f.json ==1821184== ==1821184== Conditional jump or move depends on uninitialised value(s) ==1821184== at 0x4899F2F: VMatrix::rotate(float, VMatrix::Axis) (vmatrix.cpp:240) ==1821184== by 0x48C968F: rlottie::internal::model::Transform::Data::matrix(int, bool) const (lottiemodel.cpp:197) ==1821184== by 0x48AE69D: rlottie::internal::model::Transform::matrix(int, bool) const (lottiemodel.h:618) ==1821184== by 0x48AE918: rlottie::internal::model::Layer::matrix(int) const (lottiemodel.h:700) ==1821184== by 0x48A7C3D: rlottie::internal::renderer::Layer::matrix(int) const (lottieitem.cpp:440) ==1821184== by 0x48A79D9: rlottie::internal::renderer::Layer::update(int, VMatrix const&, float) (lottieitem.cpp:404) ==1821184== by 0x48A8DF4: rlottie::internal::renderer::CompLayer::updateContent() (lottieitem.cpp:653) ==1821184== by 0x48A7B60: rlottie::internal::renderer::Layer::update(int, VMatrix const&, float) (lottieitem.cpp:430) ==1821184== by 0x48A62F1: rlottie::internal::renderer::Composition::update(int, VSize const&, bool) (lottieitem.cpp:146) ==1821184== by 0x48F6E79: AnimationImpl::update(unsigned long, VSize const&, bool) (lottieanimation.cpp:105) ==1821184== by 0x48F6F90: AnimationImpl::render(unsigned long, rlottie::Surface const&, bool) (lottieanimation.cpp:118) ==1821184== by 0x48F7AF3: rlottie::Animation::renderSync(unsigned long, rlottie::Surface, bool) (lottieanimation.cpp:371) ==1821184== Uninitialised value was created by a stack allocation ==1821184== at 0x48E41FA: void LottieParserImpl::parseKeyFrameCase 2
Accessing elements of empty vector. 002f.json
{"v":"0","op":1,"layers":[{"ty":4,"ks":{},"shapes":[{"ty":"gr","it":[{"ty":"sh","ks":{"k":[{}]}}]}],"op":1}]}Click to see output (gdb ...)
``` mymedia@barberry:~/rlottie$ gdb -ex run -ex bt\ full -ex q --args build/example/lottie2gif fuzz/collect/002f.json Reading symbols from build/example/lottie2gif... Starting program: /home/mymedia/rlottie/build/example/lottie2gif fuzz/collect/002f.json [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. rlottie::internal::model::PropertyCases 3, 4, 5
Stack overflow on cyclic structures. 009f.json
{"v":"0","assets":[{"id":"a","layers":[{"ks":{},"ty":0,"refId":"a"}]}],"layers":[{"ks":{},"ty":0,"refId":"a"}]}010f.json{"v":"0","assets":[{"id":"b","layers":[{"ks":{},"ty":0,"refId":"b"}]}],"layers":[{"ks":{}},{"ks":{},"ty":0,"refId":"b"}]}011f.json{"v":"0","assets":[{"id":"c","layers":[{"ks":{},"ty":0,"refId":"c"}]}],"layers":[{"ks":{},"ty":0,"refId":"c"},{"ks":{},"ty":0,"refId":""}]}(Sorry for gaps between file numbers. I tried to minimize other samples but they seem irrelevant).Click to see output (gdb ...)
``` mymedia@barberry:~/rlottie$ gdb -ex run -ex bt\ full\ -20 -ex q --args build/example/lottie2gif fuzz/collect/009f.json Reading symbols from build/example/lottie2gif... Starting program: /home/mymedia/rlottie/build/example/lottie2gif fuzz/collect/009f.json [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f7ea48 in std::vectorCase 6
Stack overflow at VBezier::length(). 013f.json
{"v":"0","op":9,"layers":[{"ty":4,"ks":{},"shapes":[{"ty":"gr","it":[{"ty":"sh","ks":{"k":{"i":[[],[]],"o":[[0,2000000000],[]],"v":[[],[1200000]]}}}]},{"ty":"tm","s":{"k":[{"i":{},"s":[100]},{"t":9}]}}],"op":9}]}Click to see output (gdb ...)
``` mymedia@barberry:~/rlottie$ gdb -ex run -ex bt\ full\ -40 -ex q --args build/example/lottie2gif fuzz/collect/013f.json Reading symbols from build/example/lottie2gif... Starting program: /home/mymedia/rlottie/build/example/lottie2gif fuzz/collect/013f.json [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f51a94 in VBezier::split (this=