Fix null dereference comparing CompressedVector prototypes - #356
Merged
asmaloney merged 2 commits intoAug 28, 2026
Conversation
CompressedVectorNodeImpl's prototype_ and codecs_ are set after construction via setPrototype()/setCodecs(), so both can be null. Every other use in this file checks for that, but isTypeEquivalent() did not -- passing a null prototype into StructureNodeImpl::isTypeEquivalent() dereferences it via ni->type(). A malformed XML section can produce such a node, which crashes while parsing. Treat a missing prototype or codecs as not equivalent, which is the same result a mismatch already gives. codecs_ is guarded too since it has the same issue one line later.
Owner
|
Thanks Benjamin! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the null dereference from GHSA-f7fw-gw7v-2h7g.
prototype_andcodecs_are set after construction viasetPrototype()/setCodecs(), so both can legitimately be null. Every other use inCompressedVectorNodeImpl.cppchecks for that (lines 52, 97, 178, 184, 227, 231,244, 253) —
isTypeEquivalent()was the one place that didn't, so passing a nullprototype into
StructureNodeImpl::isTypeEquivalent()dereferenced it atni->type().A missing prototype or codecs is now treated as "not equivalent", which is the
same answer a mismatch already gives.
codecs_is guarded as well: it has the identical gap one line later. Ourreproducer happens to trip the prototype path first, but a later fuzzing run did
produce an input that reaches the
codecs_line, so both are needed.Verified locally against
21c2943:(with
E57_ERROR_HOMOGENEOUS_VIOLATION, i.e. the real structural problem is nowreported), and all 6 still crash without it.
libE57Format-test-dataplus 31 generated through the
WriterAPI across node types, bit widths,cartesian/spherical geometry, optional-field combinations, scan counts and
Image2D sections — give identical open/reject results before and after.
Happy to adjust anything. Let me know when you've added your test case and I'll
rebase if needed.