A SEGV fault was discovered in clip

[Asteriska001]

Description

A SEGV fault was discovered in function clip::plotgen::vectors_draw()

Version

Version 5fca358 (Lastest commit)

Environment

Ubuntu 18.04, 64bit

Reproduce

Command

git clone the Lastest Version firstly.
make
./clip -e a.svg  ./poc

POC file at the bottom of this report.

ASAN Report

=================================================================
==1292==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5638486da40a bp 0x7ffda770bdc0 sp 0x7ffda770b9
20 T0)
==1292==The signal is caused by a READ memory access.
==1292==Hint: address points to the zero page.
    #0 0x5638486da40a in clip::plotgen::vectors_draw(clip::Context*, clip::PlotConfig*, clip::plotgen::PlotVectorsConfig*) (
/AFLplusplus/my_test/clip-master/val/clip+0x2ef40a)
    #1 0x5638486df50d in clip::plotgen::vectors_draw(clip::Context*, clip::PlotConfig*, clip::Expr const*) (/AFLplusplus/my_
test/clip-master/val/clip+0x2f450d)
    #2 0x5638486c2526 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::P
lotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*>(std::__invoke_other, clip::ReturnCod
e (*&)(clip::Context*, clip::PlotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*&&) (/AF
Lplusplus/my_test/clip-master/val/clip+0x2d7526)
    #3 0x5638486c2225 in std::__invoke_result<clip::ReturnCode (*&)(clip::Context*, clip::PlotConfig*, clip::Expr const*), c
lip::Context*&, clip::PlotConfig*&, clip::Expr const*>::type std::__invoke<clip::ReturnCode (*&)(clip::Context*, clip::PlotC
onfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*>(clip::ReturnCode (*&)(clip::Context*, cl
ip::PlotConfig*, clip::Expr const*), clip::Context*&, clip::PlotConfig*&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-ma
ster/val/clip+0x2d7225)
    #4 0x5638486c1df3 in clip::ReturnCode std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholde
r<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>::__call<clip::ReturnCode, clip::Expr const*&&, 0ul, 1ul, 2ul>(
std::tuple<clip::Expr const*&&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/AFLplusplus/my_test/clip-master/val/clip+0x2d6df3)
    #5 0x5638486c19b8 in clip::ReturnCode std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholde
r<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>::operator()<clip::Expr const*, clip::ReturnCode>(clip::Expr co
nst*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d69b8)
#6 0x5638486c1302 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*
, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>(std:
:__invoke_other, std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, cl
ip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d6302)
    #7 0x5638486c0d99 in std::enable_if<is_invocable_r_v<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*, cl
ip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>, clip::R
eturnCode>::type std::__invoke_r<clip::ReturnCode, std::_Bind<clip::ReturnCode (*(clip::Context*, clip::PlotConfig*, std::_P
laceholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr const*>(std::_Bind<clip::ReturnCode (*(c
lip::Context*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)>&, clip::Expr
 const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d5d99)
    #8 0x5638486c0756 in std::_Function_handler<clip::ReturnCode (clip::Expr const*), std::_Bind<clip::ReturnCode (*(clip::C
ontext*, clip::PlotConfig*, std::_Placeholder<1>))(clip::Context*, clip::PlotConfig*, clip::Expr const*)> >::_M_invoke(std::
_Any_data const&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x2d5756)
    #9 0x56384871aee1 in std::function<clip::ReturnCode (clip::Expr const*)>::operator()(clip::Expr const*) const (/AFLplusp
lus/my_test/clip-master/val/clip+0x32fee1)
 #10 0x563848718472 in clip::expr_walk_map(clip::Expr const*, std::unique_ptr<clip::Expr, std::function<void (clip::Expr*
)> >*, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::function<cli
p::ReturnCode (clip::Expr const*)>, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> 
> >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pa
ir<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::function<clip::ReturnCode (cl
ip::Expr const*)> > > > const&) (/AFLplusplus/my_test/clip-master/val/clip+0x32d472)
    #11 0x5638486bb326 in clip::plot_draw(clip::Context*, clip::PlotConfig*, clip::Expr const*) (/AFLplusplus/my_test/clip-m
aster/val/clip+0x2d0326)
    #12 0x5638486bc4da in clip::plot_eval(clip::Context*, clip::Expr const*) (/AFLplusplus/my_test/clip-master/val/clip+0x2d
14da)
    #13 0x5638485628a4 in clip::ReturnCode std::__invoke_impl<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::
Expr const*), clip::Context*, clip::Expr const*>(std::__invoke_other, clip::ReturnCode (*&)(clip::Context*, clip::Expr const
*), clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x1778a4)
    #14 0x563848561f33 in std::enable_if<is_invocable_r_v<clip::ReturnCode, clip::ReturnCode (*&)(clip::Context*, clip::Expr
 const*), clip::Context*, clip::Expr const*>, clip::ReturnCode>::type std::__invoke_r<clip::ReturnCode, clip::ReturnCode (*&
)(clip::Context*, clip::Expr const*), clip::Context*, clip::Expr const*>(clip::ReturnCode (*&)(clip::Context*, clip::Expr co
nst*), clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/my_test/clip-master/val/clip+0x176f33)
    #15 0x56384856145a in std::_Function_handler<clip::ReturnCode (clip::Context*, clip::Expr const*), clip::ReturnCode (*)(
clip::Context*, clip::Expr const*)>::_M_invoke(std::_Any_data const&, clip::Context*&&, clip::Expr const*&&) (/AFLplusplus/m
y_test/clip-master/val/clip+0x17645a)
    #16 0x5638485612a2 in std::function<clip::ReturnCode (clip::Context*, clip::Expr const*)>::operator()(clip::Context*, cl
ip::Expr const*) const (/AFLplusplus/my_test/clip-master/val/clip+0x1762a2)
    #17 0x56384855f573 in clip::eval(clip::Context*, clip::Expr const*) (/AFLplusplus/my_test/clip-master/val/clip+0x174573)
    #18 0x56384855fc87 in clip::eval(clip::Context*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator
<char> > const&) (/AFLplusplus/my_test/clip-master/val/clip+0x174c87)
    #19 0x56384847230a in main (/AFLplusplus/my_test/clip-master/val/clip+0x8730a)
    #20 0x7f86bed29082 in __libc_start_main ../csu/libc-start.c:308
    #21 0x5638484709fd in _start (/AFLplusplus/my_test/clip-master/val/clip+0x859fd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/AFLplusplus/my_test/clip-master/val/clip+0x2ef40a) in clip::plotgen::vectors_draw(clip::Co
ntext*, clip::PlotConfig*, clip::plotgen::PlotVectorsConfig*)
==1292==ABORTING

POC

id_000000,sig_11,src_000835,time_7526805,op_havoc,rep_4.zip

Any issue plz contact with me:
[email protected]
OR:
twitter: @Asteriska8