lvandeve / lodepng

PNG encoder and decoder in C and C++.
zlib License
2.03k stars 420 forks source link

Fix undefined behavior found by UBSan fuzzing #167

Closed hpjansson closed 2 years ago

hpjansson commented 2 years ago

If you build an executable using lodepng with -g -Og -fsanitize=address,undefined -fsanitize-no-recover=all in CFLAGS and try to load this image file, the program will abort with the following output:

lodepng.c:1370:28: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior lodepng.c:1370:28

The fix is to check for a NULL pointer before trying to do calculations with it.

lvandeve commented 2 years ago

Thanks for fixing!