search

michaelrsweet / mxml

Tiny XML library.
https://www.msweet.org/mxml
Apache License 2.0
428 stars 157 forks source link

Another SEGV in Function write_element #236

Closed fouzhe closed 5 years ago

fouzhe commented 5 years ago

I used clang 6.0 and AddressSanitizer to build mxml 2.12, this file can cause SEGV in function write_element in mxmldoc.c when executing this command(note:this issue is different from #235 because the trace is different!):

./testmxml $crash 1.xml

This is the ASAN information:

==30934==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000038 (pc 0x0000004095a0 bp 0x60800000bf20 sp 0x7fff5b96eca0 T0)
    #0 0x40959f in write_element /home/fouzhe/my_fuzz/mxml/mxmldoc.c:3796
    #1 0x40c47d in write_scu /home/fouzhe/my_fuzz/mxml/mxmldoc.c:5786
    #2 0x40cdeb in write_html_body /home/fouzhe/my_fuzz/mxml/mxmldoc.c:4748
    #3 0x40e9cb in write_html /home/fouzhe/my_fuzz/mxml/mxmldoc.c:4551
    #4 0x402e35 in main /home/fouzhe/my_fuzz/mxml/mxmldoc.c:602
    #5 0x7f1be4e8c82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #6 0x402ff8 in _start (/home/fouzhe/my_fuzz/mxml/mxmldoc+0x402ff8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fouzhe/my_fuzz/mxml/mxmldoc.c:3796 write_element
michaelrsweet commented 5 years ago

@fouzhe I'm sorry, but I really don't know what to do with this. The backtrace is for mxmldoc, but the command you've provided is the unit test program. The referenced file is garbage.

michaelrsweet commented 5 years ago

and regardless of the backtrace being different, the location of the crash is the same as Issue #235. Closing as dupe.

michaelrsweet commented 5 years ago

FWIW, changes in the codedoc project fix this issue.