]> granicus.if.org Git - graphviz/commitdiff
fix: avoid accessing min/max rep on a NULL cluster
authorMatthew Fernandez <matthew.fernandez@gmail.com>
Sun, 9 Aug 2020 23:50:14 +0000 (16:50 -0700)
committerMatthew Fernandez <matthew.fernandez@gmail.com>
Sat, 15 Aug 2020 17:20:22 +0000 (10:20 -0700)
When entering compile_samerank, the parent cluster could be NULL, which was then
incorrectly dereferenced in the two cases affected in this change. This issue
was found by Google Autofuzz project. Related to #1676.

lib/dotgen/rank.c

index 8c26d907bcd510dfd84d318159f0c60d169a02ba..e8b721d7d52ed822f52db4dcc50a4cbc5a6472ba 100644 (file)
@@ -836,13 +836,17 @@ static void compile_samerank(graph_t * ug, graph_t * parent_clust)
        GD_has_sourcerank(clust) = TRUE;        /* fall through */
     case MINRANK:
        leader = union_all(ug);
-       GD_minrep(clust) = union_one(leader, GD_minrep(clust));
+       if (clust != NULL) {
+           GD_minrep(clust) = union_one(leader, GD_minrep(clust));
+       }
        break;
     case SINKRANK:
        GD_has_sinkrank(clust) = TRUE;  /* fall through */
     case MAXRANK:
        leader = union_all(ug);
-       GD_maxrep(clust) = union_one(leader, GD_maxrep(clust));
+       if (clust != NULL) {
+           GD_maxrep(clust) = union_one(leader, GD_maxrep(clust));
+       }
        break;
     case SAMERANK:
        leader = union_all(ug);