Closed timothyqiu closed 3 months ago
Do you know if there's more information about the svg I can pass to the thorvg folks @hermet
Narrowed down to the icon of this plugin.
Extract svg_heap_buffer_overflow.zip. Open the project in a sanitizer build crashes with heap-buffer-overflow
during the asset import process.
Edit: Narrowed down further. Save the following script as test.gd
.
The issue can be reproduced by executing godot --headless -s test.gd
.
@fire thorvg svg maintainers: @JSUYA @mgrudzinska
We will check our side as well, thanks.
Hi I tested the attached svg images(icon.svg, RemoteTransformControl.svg) with version 0.12.10 (e69d63688b) of thorvg, but was unable to reproduce the problem. Recently, various issues in the svg loader module have been fixed. Can you check whether the same problem occurs in the latest version of thorvg?
@JSUYA Hi
In the parser code, I find thorvg uses lots of string functions like strlen
and strchr
.
However, SvgLoader::open()
accepts a buffer pointer & size, it's not necessarily null terminated.
Making the function allocate size + 1
and put null at content[size]
fixes the problem :tada:
Hello, @JSUYA has handled the issue. The fix will be applied in thorvg v0.13.1. thanks.
Tested versions
master[e5b4ef8e9522e950033cbece39a31a4a76da19c1]
System information
Arch Linux
Issue description
Open AssetLib in the editor, and address sanitizer decides to crash the editor.
ASan Output
``` ==4963==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5190024df0fd at pc 0x75ecfa4818df bp 0x75ecc75ff540 sp 0x75ecc75fece8 READ of size 1002 at 0x5190024df0fd thread T23 #0 0x75ecfa4818de in __interceptor_strlen /usr/src/debug/gcc/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:461 #1 0x55d2960687ca in tvg::strDuplicate(char const*, unsigned long) thirdparty/thorvg/src/common/tvgStr.cpp:219 #2 0x55d2960ab2d8 in simpleXmlParseCSSAttribute(char const*, unsigned int, char**, char**, char const**, unsigned int*) thirdparty/thorvg/src/loaders/svg/tvgXmlParser.cpp:564 #3 0x55d296087edc in _svgLoaderParserXmlCssStyle thirdparty/thorvg/src/loaders/svg/tvgSvgLoader.cpp:3164 #4 0x55d29608860e in _svgLoaderParser thirdparty/thorvg/src/loaders/svg/tvgSvgLoader.cpp:3208 #5 0x55d2960aa633 in simpleXmlParse(char const*, unsigned int, bool, bool (*)(void*, SimpleXMLType, char const*, unsigned int), void const*) thirdparty/thorvg/src/loaders/svg/tvgXmlParser.cpp:454 #6 0x55d29608ac01 in SvgLoader::run(unsigned int) thirdparty/thorvg/src/loaders/svg/tvgSvgLoader.cpp:3557 #7 0x55d296114394 in tvg::Task::operator()(unsigned int) thirdparty/thorvg/src/renderer/tvgTaskScheduler.h:64 #8 0x55d296115631 in tvg::TaskSchedulerImpl::run(unsigned int) thirdparty/thorvg/src/renderer/tvgTaskScheduler.cpp:153 #9 0x55d296114e66 in tvg::TaskSchedulerImpl::TaskSchedulerImpl(unsigned int)::{lambda()#1}::operator()() const thirdparty/thorvg/src/renderer/tvgTaskScheduler.cpp:120 #10 0x55d296116a57 in void std::__invoke_implSteps to reproduce
Make sure your editor build has Address Sanitizer enabled.
Open AssetLib tab inside the editor, search for "Remote Transform" and wait.
Or extract and open the MRP with the editor.
Minimal reproduction project (MRP)
svg_heap_buffer_overflow.zip