Hi,
While fuzzing FontForge with AFL, I found a NULL pointer dereference in the SFDGetSpiros() function, in sfd.c.
Attaching a reproducer (gzipped so GitHub accepts it): test03.sfd.gz
Issue can be reproduced in FontForge 20190801 and with latest Git master by running:
=================================================================
==4457==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ff8c0d8e2bf bp 0x7fffda0289f0 sp 0x7fffda028930 T0)
==4457==The signal is caused by a READ memory access.
==4457==Hint: address points to the zero page.
#0 0x7ff8c0d8e2be in SFDGetSpiros /home/fcambus/fontforge-20190801/fontforge/sfd.c:4039
#1 0x7ff8c0d8e876 in SFDGetSplineSet /home/fcambus/fontforge-20190801/fontforge/sfd.c:4083
#2 0x7ff8c0d9e9f7 in SFDGetChar /home/fcambus/fontforge-20190801/fontforge/sfd.c:5698
#3 0x7ff8c0dc0f3d in SFD_GetFont /home/fcambus/fontforge-20190801/fontforge/sfd.c:8984
#4 0x7ff8c0dc1e0f in SFD_Read /home/fcambus/fontforge-20190801/fontforge/sfd.c:9077
#5 0x7ff8c0dc2360 in _SFDRead /home/fcambus/fontforge-20190801/fontforge/sfd.c:9110
#6 0x7ff8c0e1b7bd in _ReadSplineFont /home/fcambus/fontforge-20190801/fontforge/splinefont.c:1178
#7 0x7ff8c0e1d0bf in ReadSplineFont /home/fcambus/fontforge-20190801/fontforge/splinefont.c:1321
#8 0x7ff8c0e1d591 in LoadSplineFont /home/fcambus/fontforge-20190801/fontforge/splinefont.c:1379
#9 0x7ff8c09dbbbc in ViewPostScriptFont /home/fcambus/fontforge-20190801/fontforge/fontviewbase.c:1347
#10 0x7ff8c282a89e in fontforge_main /home/fcambus/fontforge-20190801/fontforgeexe/startui.c:1392
#11 0x559d8dc361ec in main /home/fcambus/fontforge-20190801/fontforgeexe/main.c:33
#12 0x7ff8c1eb61e2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x271e2)
#13 0x559d8dc3610d in _start (/home/fcambus/fontforge-20190801/fontforgeexe/.libs/fontforge+0x110d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fcambus/fontforge-20190801/fontforge/sfd.c:4039 in SFDGetSpiros
==4457==ABORTING
Hi,
While fuzzing FontForge with AFL, I found a NULL pointer dereference in the SFDGetSpiros() function, in sfd.c.
Attaching a reproducer (gzipped so GitHub accepts it): test03.sfd.gz
Issue can be reproduced in FontForge 20190801 and with latest Git master by running: