Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

image/png: nil deref #10493

Closed
dvyukov opened this issue Apr 17, 2015 · 1 comment
Closed

image/png: nil deref #10493

dvyukov opened this issue Apr 17, 2015 · 1 comment
Milestone

Comments

@dvyukov
Copy link
Member

dvyukov commented Apr 17, 2015

go version devel +8ea2438 Fri Apr 17 13:44:30 2015 +0300 linux/amd64

The following program crashes with nil deref:

package main

import (
    "bytes"
    "encoding/hex"
    "image/png"
)

func main() {
    data, _ := hex.DecodeString("89504e470d0a1a0a0000000d49484452000000300000003008060000005702f9" +
        "870000000467414d41000186a031e8965f000000e5494441545885d596c10a83" +
        "301044a7e0417fcb7eb7fdadf6961e06039286266693cc7a188645e43dd6a08f" +
        "1042003e2fe09aef6472737e183d27335fcee2f35a77b702ebce742870a23397" +
        "f3edf2705dd10160f3b2815fe8ecf2027974a6b0c03f74a6e4192843e75c6c03" +
        "35e8ec3202f5e84c0181bbe8cca967a00d9df3491bb040671f2e6087ce1c2860" +
        "8d1e05f8c7ee0f1d00b667e70df44467ef26d01fbd9bc028f42860f71d188bce" +
        "fb8d3630039dbd59601e7ab3c06cf428507f0634d039afdc80123a7bb1801e7a" +
        "b1802a7a14c89f016d74ce331bf080ce9e08f8414f04bca133bfe642fe5e4e20" +
        "bec50000000049454e44ae426082")
    img, err := png.Decode(bytes.NewReader(data))
    if err != nil {
        return
    }
    var w bytes.Buffer
    err = png.Encode(&w, img)
    if err != nil {
        panic(err)
    }
}
panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x28 pc=0x45f4fb]

goroutine 1 [running]:
runtime.gopanic(0x527700, 0xc20800a270)
    src/runtime/panic.go:477 +0x402 fp=0xc208041cb0 sp=0xc208041c30
runtime.panicmem()
    src/runtime/panic.go:42 +0x52 fp=0xc208041cd8 sp=0xc208041cb0
runtime.sigpanic()
    src/runtime/sigpanic_unix.go:24 +0x2bf fp=0xc208041d28 sp=0xc208041cd8
image/png.(*Encoder).Encode(0xc20800a620, 0x7f66bc63a470, 0xc20804a070, 0x0, 0x0, 0x0, 0x0)
    src/image/png/writer.go:484 +0x4b fp=0xc208041e90 sp=0xc208041d28
image/png.Encode(0x7f66bc63a470, 0xc20804a070, 0x0, 0x0, 0x0, 0x0)
    src/image/png/writer.go:476 +0x6c fp=0xc208041ed0 sp=0xc208041e90
main.main()
    png.go:25 +0x1aa fp=0xc208041f90 sp=0xc208041ed0
@dvyukov dvyukov added this to the Go1.5 milestone Apr 17, 2015
@syst3mw0rm
Copy link
Contributor

png.Decode should either return non-nil image.Image object or non-nil error. Both img and err are nil in this case.

@golang golang locked and limited conversation to collaborators Jun 25, 2016
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants