Skip to content

Segmentation Fault in plutofilter_color_transform due to missing NULL pointer check #5

@Focing123

Description

@Focing123

Description
I have identified a Segmentation Fault (Crash) in the plutofilter library. The issue occurs when a plutofilter_surface_t structure is initialized with a NULL pixel buffer and passed to processing functions like plutofilter_color_transform.

Vulnerability Type
NULL Pointer Dereference (CWE-476).

Location
File: plutofilter.h
Line: 460 (inside plutofilter_color_transform)

Root Cause
The library macros (specifically PLUTOFILTER_GET_PIXEL) access the pixels array without verifying if the pointer is valid.

#define PLUTOFILTER_GET_PIXEL(surface, x, y) \
    ((surface).pixels[(y) * (surface).stride + (x)])

Steps to Reproduce
Compile the following C code with plutofilter.h:

#define PLUTOFILTER_IMPLEMENTATION
#include "plutofilter.h"
#include <stdio.h>


int main(void) {
    plutofilter_surface_t toxic_surface;
    toxic_surface.width = 100;
    toxic_surface.height = 100;
    toxic_surface.stride = 100;
    // The vulnerability: passing NULL as the pixel buffer
    toxic_surface.pixels = NULL; 

    // This triggers the crash
    plutofilter_color_transform_invert(toxic_surface, toxic_surface, 1.0f);
    return 0;
}

Crash Log (AddressSanitizer)

==128771==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
    #0 0x55a670865a0b in plutofilter_color_transform plutofilter.h:460
    #1 0x55a67086734e in plutofilter_color_transform_invert plutofilter.h:513
SUMMARY: AddressSanitizer: SEGV plutofilter.h:460 in plutofilter_color_transform

Suggested Fix
Add a validation check at the start of public functions to ensure surface.pixels is not NULL.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions