-
-
Notifications
You must be signed in to change notification settings - Fork 9
Open
Description
Description
I have identified a Segmentation Fault (Crash) in the plutofilter library. The issue occurs when a plutofilter_surface_t structure is initialized with a NULL pixel buffer and passed to processing functions like plutofilter_color_transform.
Vulnerability Type
NULL Pointer Dereference (CWE-476).
Location
File: plutofilter.h
Line: 460 (inside plutofilter_color_transform)
Root Cause
The library macros (specifically PLUTOFILTER_GET_PIXEL) access the pixels array without verifying if the pointer is valid.
#define PLUTOFILTER_GET_PIXEL(surface, x, y) \
((surface).pixels[(y) * (surface).stride + (x)])Steps to Reproduce
Compile the following C code with plutofilter.h:
#define PLUTOFILTER_IMPLEMENTATION
#include "plutofilter.h"
#include <stdio.h>
int main(void) {
plutofilter_surface_t toxic_surface;
toxic_surface.width = 100;
toxic_surface.height = 100;
toxic_surface.stride = 100;
// The vulnerability: passing NULL as the pixel buffer
toxic_surface.pixels = NULL;
// This triggers the crash
plutofilter_color_transform_invert(toxic_surface, toxic_surface, 1.0f);
return 0;
}Crash Log (AddressSanitizer)
==128771==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
#0 0x55a670865a0b in plutofilter_color_transform plutofilter.h:460
#1 0x55a67086734e in plutofilter_color_transform_invert plutofilter.h:513
SUMMARY: AddressSanitizer: SEGV plutofilter.h:460 in plutofilter_color_transform
Suggested Fix
Add a validation check at the start of public functions to ensure surface.pixels is not NULL.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels