https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79135
Bug ID: 79135
Summary: null pointer dereference in
std::_Bit_reference::operator=(bool)
(stl_bvector.h:87)
Product: gcc
Version: 6.2.1
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: libstdc++
Assignee: unassigned at gcc dot gnu.org
Reporter: brian.carpenter at gmail dot com
Target Milestone: ---
Created attachment 40538
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=40538&action=edit
crashing test case
While fuzzing draco by Google (https://github.com/google/draco) with American
Fuzzy Lop, I was able to trigger a null pointer dereference and segfault in
libstdc++ v6.2.1.
./draco_decoder -i test012
ASAN:DEADLYSIGNAL
=================================================================
==15020==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x0000005c2b24 bp 0x000000000000 sp 0x7fff9aa895a0 T0)
#0 0x5c2b23 in std::_Bit_reference::operator=(bool)
/usr/bin/../lib/gcc/x86_64-linux-gnu/6.2.1/../../../../include/c++/6.2.1/bits/stl_bvector.h:87:8
#1 0x5c2b23 in
draco::MeshAttributeCornerTable::AddSeamEdge(draco::IndexType<int,
draco::CornerIndex_tag_type_>)
/root/draco/mesh/mesh_attribute_corner_table.cc:102
#2 0x51dda7 in
draco::MeshEdgeBreakerDecoderImpl<draco::MeshEdgeBreakerTraversalDecoder>::DecodeConnectivity()
/root/draco/compression/mesh/mesh_edgebreaker_decoder_impl.cc:291:7
#3 0x5661d9 in draco::PointCloudDecoder::Decode(draco::DecoderBuffer*,
draco::PointCloud*)
/root/draco/compression/point_cloud/point_cloud_decoder.cc:28:8
#4 0x513573 in draco::DecodeMeshFromBuffer(draco::DecoderBuffer*)
/root/draco/compression/decode.cc:117:8
#5 0x50f9de in main /root/draco/tools/draco_decoder.cc:93:44
#6 0x7f5730a492b0 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
#7 0x43c9e9 in _start (/root/draco/build/draco_decoder+0x43c9e9)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/usr/bin/../lib/gcc/x86_64-linux-gnu/6.2.1/../../../../include/c++/6.2.1/bits/stl_bvector.h:87:8
in std::_Bit_reference::operator=(bool)
==15020==ABORTING
