Repository navigation
Conversation
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 5 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
stweil
force-pushed
the
ghsa-vf7v-pagerenderer
branch
from
October 18, 2026 18:49
0e86d38 to
547ac18
Compare
Member
Author
|
@router0mail, please review. |
stweil
force-pushed
the
ghsa-vf7v-pagerenderer
branch
from
October 18, 2026 19:28
547ac18 to
88e423c
Compare
stweil
force-pushed
the
main
branch
2 times, most recently
from
October 19, 2026 07:16
47b149e to
f87ce60
Compare
AppendLinePolygon freed a Pta it did not own. The right-to-left accumulator was passed by value as Pta *, so ptaDestroy released the allocation and nulls only the callee's local copy; the caller's line_top_rtl_pts / line_bottom_rtl_pts (created once before the page loop and never reassigned) were left dangling. That branch is entered once per recognised word whose writing direction is right-to-left, so on any page containing at least two such words the dangling pointer was read (ptaGetCount/ptaJoin) and freed again, and the stale coordinates were joined into the line polygon - which can trigger a heap-buffer-overflow in RecalcPolygonline. This uses the fix suggested in the GHSA-vf7v-2h4f-6f4j advisory: take the RTL accumulator by pointer-to-pointer so the function can hand the replacement back. This also repairs two further defects in the same function: the RTL branch discarded its result (right-to-left word polygons were never accumulated) and leaked the ptsd copy. Add a PAGEXMLRightToLeftPolygon regression test that renders hebrew.png (already in the test data) through GetPAGEText at word level with polygons enabled. Under AddressSanitizer it crashes on the unfixed code and is clean on the fixed code. The regression test exposed a pre-existing leak in RecalcPolygonline: the num_pts == 2 early return skipped the numaDestroy of bin_line, which had been created before the check. Each call with a 2-point polygon leaked one NUMA. LeakSanitizer (running in the Linux ASan CI jobs) flagged this, so destroy bin_line in the early-return branch as well. Also release the test's source image right after SetImage: the API clones the image, so the local copy is not needed any longer, and destroying it early keeps every early-return path (GTEST_SKIP, ASSERT_TRUE) from leaking it under LeakSanitizer. Fixes GHSA-vf7v-2h4f-6f4j Suggested-by: Jipa Alexandru-Ionut <jipaionut@gmail.com> Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) Signed-off-by: Stefan Weil <sw@weilnetz.de>
stweil
force-pushed
the
ghsa-vf7v-pagerenderer
branch
from
October 19, 2026 07:29
88e423c to
bc29121
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AppendLinePolygon freed a Pta it did not own. The right-to-left accumulator was passed by value as Pta *, so ptaDestroy released the allocation and nulls only the callee's local copy; the caller's line_top_rtl_pts / line_bottom_rtl_pts (created once before the page loop and never reassigned) were left dangling. That branch is entered once per recognised word whose writing direction is right-to-left, so on any page containing at least two such words the dangling pointer was read (ptaGetCount/ptaJoin) and freed again, and the stale coordinates
were joined into the line polygon - which can trigger a heap-buffer-overflow in RecalcPolygonline.
This uses the fix suggested in the GHSA-vf7v-2h4f-6f4j advisory: take the RTL accumulator by pointer-to-pointer so the function can hand the replacement back. This also repairs two further defects in the same
function: the RTL branch discarded its result (right-to-left word polygons were never accumulated) and leaked the ptsd copy.
Add a PAGEXMLRightToLeftPolygon regression test that renders hebrew.png (already in the test data) through GetPAGEText at word level with polygons enabled. Under AddressSanitizer it crashes on the unfixed code and is clean on the fixed code.
The regression test exposed a pre-existing leak in RecalcPolygonline: the num_pts == 2 early return skipped the numaDestroy of bin_line, which had been created before the check. Each call with a 2-point polygon leaked one NUMA. LeakSanitizer (running in the Linux ASan CI jobs) flagged this, so destroy bin_line in the early-return branch as well.
Fixes GHSA-vf7v-2h4f-6f4j
Suggested-by: Jipa Alexandru-Ionut jipaionut@gmail.com
Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
Signed-off-by: Stefan Weil sw@weilnetz.de