Repository navigation
Remove unconditional warnings - #3
Closed
baskerville wants to merge 1 commit into
Closed
baskerville wants to merge 1 commit into
baskerville wants to merge 1 commit into
Conversation
It would seem that the removed warnings acted as a reminder for unimplemented features: TODOs will do here.
Author
|
This was fixed in f9eaf32. |
GerHobbelt
pushed a commit
to GerHobbelt/mupdf
that referenced
this pull request
Apr 20, 2020
Merge from master
GerHobbelt
pushed a commit
to GerHobbelt/mupdf
that referenced
this pull request
Dec 9, 2022
$ ./build/sanitize/mutool draw -Dst ./x/tiff/segfault/goat.tiff
page ./x/tiff/segfault/goat.tiff 1AddressSanitizer:DEADLYSIGNAL
=================================================================
==3377970==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x55dfed459a1b bp 0x7ffecf93ebc0 sp 0x7ffecf93eac0 T0)
==3377970==The signal is caused by a READ memory access.
==3377970==Hint: address points to the zero page.
#0 0x55dfed459a1b in fz_convert_pixmap_samples source/fitz/colorspace.c:1421
#1 0x55dfed57bad0 in fz_convert_pixmap source/fitz/pixmap.c:1065
#2 0x55dfed481194 in convert_pixmap_for_painting source/fitz/draw-device.c:1682
ArtifexSoftware#3 0x55dfed482e2c in fz_draw_fill_image source/fitz/draw-device.c:1852
ArtifexSoftware#4 0x55dfed461d34 in fz_fill_image source/fitz/device.c:351
ArtifexSoftware#5 0x55dfed7841a0 in img_run_page source/cbz/muimg.c:105
ArtifexSoftware#6 0x55dfed466fe9 in fz_run_page_contents source/fitz/document.c:642
ArtifexSoftware#7 0x55dfed467358 in fz_run_page source/fitz/document.c:692
ArtifexSoftware#8 0x55dfed3ebbc9 in drawband source/tools/mudraw.c:624
ArtifexSoftware#9 0x55dfed3f0e91 in dodrawpage source/tools/mudraw.c:1125
ArtifexSoftware#10 0x55dfed3f32c1 in drawpage source/tools/mudraw.c:1460
ArtifexSoftware#11 0x55dfed3f3716 in drawrange source/tools/mudraw.c:1499
ArtifexSoftware#12 0x55dfed3f8fcf in mudraw_main source/tools/mudraw.c:2501
ArtifexSoftware#13 0x55dfed3e9736 in main source/tools/mutool.c:152
ArtifexSoftware#14 0x7fae19829209 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
ArtifexSoftware#15 0x7fae198292bb in __libc_start_main_impl ../csu/libc-start.c:389
ArtifexSoftware#16 0x55dfed3e8f60 in _start (/home/sebras/src/mupdf/build/sanitize/mutool+0x21bf60)
chris-liddell
pushed a commit
that referenced
this pull request
Jun 3, 2026
When compiling mupdf with clang MSAN and running:
mutool draw -Dst ossfuzz-518075716.html
it produces an MSAN complaint:
==904208==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 in match_an_plus_b_microsyntax source/html/css-apply.c:582:6
#1 in match_pseudo_condition source/html/css-apply.c:630:10
#2 in match_condition source/html/css-apply.c:661:17
#3 in match_selector source/html/css-apply.c:734:8
#4 in fz_match_css source/html/css-apply.c:1088:8
...
That matches this code in match_an_plus_b_microsyntax():
if (sscanf(val, " even %n", &n) == 0 && n == m)
MSAN complains that n is uninitialized in the comparson with m.
val is the string "even".
Running this example in isolation with MSAN enabled:
int n, ret = sscanf("even", " even %n", &n);
printf("ret = %d\n", ret);
printf("n = %d\n", n);
produces the same MSAN complaint independent of MuPDF when the
sample code tries to print n. It does print that ret == 0.
Running the same example _WITHOUT_ MSAN produces a print out
showing that ret == 0 and n == 4. So sscanf() DOES set n!
Presumably it is difficult for MSAN to know whether sscanf()
actually set the output argument for a %n conversion.
Initializing n to a n impossible value, e.g. -1, avoid this
MSAN complaint, and is exactly what this commit does.
This fixes OSS-fuzz 518075716.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
It would seem that the removed warnings acted as reminders for unimplemented features: TODOs will do here.