Bug 700444

Summary: stack overflow in svg_run_element
Product: MuPDF Reporter: zerokeeper <0x0keeper>
Component: mupdfAssignee: muPDF bugs <mupdf-bugs>
Status: RESOLVED DUPLICATE QA Contact: Bug traffic <tech>
Severity: normal    
Priority: P4    
Version: 1.14.0   
Hardware: PC   
OS: All   
Customer: Word Size: ---

Description zerokeeper 2019-01-05 14:35:49 UTC
Hi,mupdf team,i found a stack overflow bug  in function svg_run_element of file svg-run.c

The bug is trigered by:
./mutool draw -F svg -o out.svg mutool-stack-overflow.svg


The asan debug info is as follows:

=================================================================
==13704==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe2743cea0 (pc 0x0000008fd2d9 bp 0x7ffe2743dd50 sp 0x7ffe2743cea0 T0)
    #0 0x8fd2d8 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1059
    #1 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #2 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #3 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #4 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #5 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #6 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #7 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #8 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #9 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #10 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #11 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #12 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #13 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #14 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #15 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #16 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #17 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #18 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #19 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #20 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #21 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #22 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #23 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #24 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #25 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #26 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #27 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #28 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #29 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #30 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #31 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #32 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #33 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #34 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #35 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #36 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #37 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #38 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #39 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #40 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #41 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #42 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #43 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #44 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #45 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #46 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #47 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #48 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #49 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #50 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #51 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #52 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #53 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #54 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #55 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #56 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #57 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #58 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #59 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #60 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #61 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #62 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #63 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #64 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #65 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #66 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #67 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #68 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #69 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #70 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #71 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #72 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #73 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #74 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #75 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #76 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #77 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #78 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #79 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #80 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #81 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #82 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #83 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #84 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #85 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #86 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #87 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #88 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #89 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #90 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #91 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #92 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #93 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #94 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #95 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #96 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #97 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #98 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #99 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #100 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #101 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #102 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #103 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #104 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #105 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #106 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #107 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #108 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #109 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #110 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #111 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #112 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #113 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #114 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #115 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #116 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #117 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #118 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #119 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #120 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #121 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #122 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #123 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #124 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #125 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #126 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #127 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #128 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #129 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #130 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #131 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #132 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #133 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #134 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #135 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #136 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #137 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #138 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #139 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #140 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #141 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #142 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #143 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #144 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #145 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #146 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #147 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #148 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #149 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #150 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #151 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #152 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #153 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #154 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #155 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #156 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #157 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #158 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #159 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #160 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #161 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #162 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #163 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #164 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #165 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #166 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #167 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #168 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #169 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #170 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #171 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #172 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #173 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #174 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #175 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #176 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #177 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #178 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #179 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #180 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #181 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #182 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #183 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #184 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #185 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #186 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #187 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #188 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #189 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #190 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #191 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #192 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #193 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #194 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #195 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #196 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #197 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #198 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #199 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #200 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #201 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #202 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #203 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #204 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #205 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #206 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #207 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #208 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #209 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #210 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #211 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #212 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #213 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #214 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #215 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #216 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #217 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #218 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #219 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #220 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #221 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #222 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #223 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #224 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #225 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #226 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #227 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #228 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #229 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #230 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #231 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #232 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #233 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #234 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #235 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #236 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #237 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #238 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #239 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #240 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #241 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #242 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #243 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #244 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #245 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #246 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #247 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #248 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #249 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #250 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #251 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #252 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #253 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #254 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #255 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #256 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #257 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #258 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #259 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #260 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #261 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #262 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #263 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #264 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #265 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #266 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #267 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #268 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #269 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #270 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #271 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #272 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #273 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #274 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #275 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #276 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #277 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #278 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #279 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #280 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #281 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #282 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #283 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #284 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #285 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #286 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #287 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #288 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #289 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #290 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #291 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #292 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #293 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #294 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #295 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #296 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #297 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #298 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #299 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #300 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #301 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #302 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #303 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #304 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #305 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #306 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #307 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #308 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #309 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #310 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #311 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #312 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #313 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #314 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #315 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #316 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #317 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #318 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #319 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #320 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #321 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #322 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #323 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #324 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #325 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #326 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #327 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #328 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #329 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #330 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #331 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #332 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #333 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #334 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #335 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #336 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #337 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #338 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #339 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #340 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #341 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #342 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #343 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #344 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #345 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #346 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #347 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #348 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #349 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #350 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #351 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #352 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #353 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #354 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #355 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #356 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #357 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #358 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #359 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #360 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #361 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #362 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #363 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #364 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #365 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #366 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #367 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #368 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #369 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #370 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3
    #371 0x8fde38 in svg_run_use /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1047:5
    #372 0x8fde38 in svg_run_element /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1077
    #373 0x901297 in svg_run_use_symbol /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1020:3

SUMMARY: AddressSanitizer: stack-overflow /root/fuzz/test/mupdf-1.14.0-source/source/svg/svg-run.c:1059 in svg_run_element
==13704==ABORTING

The gdb debug info is as follow:

#gdb  -q  mutool
GEF for linux ready, type `gef' to start, `gef config' to configure
68 commands loaded for GDB 7.12.0.20161007-git using Python engine 3.6
[*] 5 commands could not be loaded, run `gef missing` to know why.
Reading symbols from mutool...done.
gef➤  set args draw -F svg -o out.svg mutool-stack-overflow.svg
gef➤  r
Starting program: /root/fuzz/test/mupdf-1.14.0-source/build/sanitize/mutool draw -F svg -o out.svg mutool-stack-overflow.svg
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: push viewport: 0 0 12 792

Program received signal SIGSEGV, Segmentation fault.
[ Legend: Modified register | Code | Heap | Stack | String ]
──────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax   : 0x0
$rbx   : 0x00007fffff7ffda0  →  0x0000000000000000
$rcx   : 0x00006210000066b8  →  0x0000000000657375  →  <fz_flatten_stroke_path+389> add BYTE PTR [rax], al
$rdx   : 0x000060e000000120  →  0x0000000000000001
$rsp   : 0x7fffff7fefe0
$rbp   : 0x00007fffff7ffe90  →  0x00007fffff800110  →  0x00007fffff800fd0  →  0x00007fffff801250  →  0x00007fffff802110  →  0x00007fffff802390  →  0x00007fffff803250  →  0x00007fffff8034d0
$rsi   : 0x000061f000000080  →  0x0000000000000001
$rdi   : 0x000060e000000040  →  0x0000000000000000
$rip   : 0x00000000008fd2d9  →  <svg_run_element+153> mov QWORD PTR [r15], 0x41b58ab3
$r8    : 0x00007fffff7fff00  →  0x000000003f800000
$r9    : 0x00000000042680f0  →  0x0000000000000003
$r10   : 0xfffffffffffffffc
$r11   : 0x1ffffffeffa8
$r12   : 0x000061f000000080  →  0x0000000000000001
$r13   : 0xf8f8f8f8f8f8f8f8
$r14   : 0x000060e000000040  →  0x0000000000000000
$r15   : 0x7fffff7fefe0
$eflags: [zero carry parity adjust sign trap INTERRUPT direction overflow RESUME virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
──────────────────────────────────────────────────────────────────────────────────────────────── stack ────
[!] Unmapped address
────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
     0x8fd2c5 <svg_run_element+133> mov    rsp, r15
     0x8fd2c8 <svg_run_element+136> movabs r13, 0xf8f8f8f8f8f8f8f8
     0x8fd2d2 <svg_run_element+146> mov    QWORD PTR [rbx+0x98], r15
 →   0x8fd2d9 <svg_run_element+153> mov    QWORD PTR [r15], 0x41b58ab3
     0x8fd2e0 <svg_run_element+160> mov    QWORD PTR [r15+0x8], 0x143861d
     0x8fd2e8 <svg_run_element+168> mov    QWORD PTR [r15+0x10], 0x8fd240
     0x8fd2f0 <svg_run_element+176> mov    rax, r15
     0x8fd2f3 <svg_run_element+179> shr    rax, 0x3
     0x8fd2f7 <svg_run_element+183> movabs rcx, 0xf2f8f2f8f1f1f1f1
───────────────────────────────────────────────────────────────────── source:source/svg/svg-run.c+1059 ────
   1054	 	fz_warn(ctx, "svg: cannot find linked symbol");
   1055	 }
   1056
   1057	 static void
   1058	 svg_run_element(fz_context *ctx, fz_device *dev, svg_document *doc, fz_xml *root, const svg_state *state)
 → 1059	 {
   1060	 	if (fz_xml_is_tag(root, "svg"))
   1061	 		svg_run_svg(ctx, dev, doc, root, state);
   1062
   1063	 	else if (fz_xml_is_tag(root, "g"))
   1064	 		svg_run_g(ctx, dev, doc, root, state);
────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "mutool", stopped, reason: SIGSEGV
──────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x8fd2d9 → svg_run_element(ctx=<optimized out>, dev=<optimized out>, doc=<optimized out>, root=0x6210000066b8, state=<optimized out>)
[#1] 0x901298 → svg_run_use_symbol(ctx=<optimized out>, dev=0x61f000000080, doc=0x60e000000120, use=0x6210000066b8, symbol=0x621000006618, inherit_state=<optimized out>)
[#2] 0x8fde39 → svg_run_use(ctx=0x60e000000040, dev=0x61f000000080, doc=0x60e000000120, root=0x6210000066b8, inherit_state=0x621000006750)
[#3] 0x8fde39 → svg_run_element(ctx=<optimized out>, dev=<optimized out>, doc=<optimized out>, root=0x6210000066b8, state=<optimized out>)
[#4] 0x901298 → svg_run_use_symbol(ctx=<optimized out>, dev=0x61f000000080, doc=0x60e000000120, use=0x6210000066b8, symbol=0x621000006618, inherit_state=<optimized out>)
[#5] 0x8fde39 → svg_run_use(ctx=0x60e000000040, dev=0x61f000000080, doc=0x60e000000120, root=0x6210000066b8, inherit_state=0x621000006750)
[#6] 0x8fde39 → svg_run_element(ctx=<optimized out>, dev=<optimized out>, doc=<optimized out>, root=0x6210000066b8, state=<optimized out>)
[#7] 0x901298 → svg_run_use_symbol(ctx=<optimized out>, dev=0x61f000000080, doc=0x60e000000120, use=0x6210000066b8, symbol=0x621000006618, inherit_state=<optimized out>)
[#8] 0x8fde39 → svg_run_use(ctx=0x60e000000040, dev=0x61f000000080, doc=0x60e000000120, root=0x6210000066b8, inherit_state=0x621000006750)
[#9] 0x8fde39 → svg_run_element(ctx=<optimized out>, dev=<optimized out>, doc=<optimized out>, root=0x6210000066b8, state=<optimized out>)
───────────────────────────────────────────────────────────────────────────────────────────────────────────
0x00000000008fd2d9 in svg_run_element (ctx=<optimized out>, dev=<optimized out>, doc=<optimized out>, root=0x6210000066b8, state=<optimized out>) at source/svg/svg-run.c:1059
1059	{
gef➤
Comment 1 Tor Andersson 2019-01-08 10:24:27 UTC

*** This bug has been marked as a duplicate of bug 700442 ***