[----------------------------------registers-----------------------------------]
RAX: 0x0
RBX: 0x10
RCX: 0xbebebebebebebebe
RDX: 0x10
RSI: 0x1
RDI: 0xacd440 ("</body>\n</html>\n")
RBP: 0x611000009950 --> 0xbebebebebebebebe
RSP: 0x7fffffffd3d0 --> 0x60300001dce0 --> 0x606023800004 --> 0x0
RIP: 0x7ffff47d56f8 (<__GI__IO_fwrite+24>: mov eax,DWORD PTR [rcx])
R8 : 0x0
R9 : 0xc220000132a --> 0x0
R10: 0x62c
R11: 0x7ffff47d56e0 (<__GI__IO_fwrite>: push r14)
R12: 0x6110000098c0 --> 0xe3bf48 --> 0x52ce50 (<HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98])
R13: 0xc2200001329 --> 0x0
R14: 0x611000009948 --> 0x0
R15: 0x603000001120 --> 0x603000001130 ("./in/poc")
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x7ffff47d56eb <__GI__IO_fwrite+11>: imul rbx,rdx
0x7ffff47d56ef <__GI__IO_fwrite+15>: test rbx,rbx
0x7ffff47d56f2 <__GI__IO_fwrite+18>: je 0x7ffff47d57e8 <__GI__IO_fwrite+264>
=> 0x7ffff47d56f8 <__GI__IO_fwrite+24>: mov eax,DWORD PTR [rcx]
0x7ffff47d56fa <__GI__IO_fwrite+26>: mov r12,rdi
0x7ffff47d56fd <__GI__IO_fwrite+29>: mov r10,rsi
0x7ffff47d5700 <__GI__IO_fwrite+32>: mov r9,rcx
0x7ffff47d5703 <__GI__IO_fwrite+35>: and eax,0x8000
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffd3d0 --> 0x60300001dce0 --> 0x606023800004 --> 0x0
0008| 0x7fffffffd3d8 --> 0x611000009950 --> 0xbebebebebebebebe
0016| 0x7fffffffd3e0 --> 0x6110000098c0 --> 0xe3bf48 --> 0x52ce50 (<HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98])
0024| 0x7fffffffd3e8 --> 0xc2200001329 --> 0x0
0032| 0x7fffffffd3f0 --> 0x611000009948 --> 0x0
0040| 0x7fffffffd3f8 --> 0x52d566 (<HtmlOutputDev::~HtmlOutputDev()+1814>: mov rcx,rbp)
0048| 0x7fffffffd400 --> 0x60600000d488 --> 0xbebebebebebebebe
0056| 0x7fffffffd408 --> 0x60300001e730 --> 0x60300001e740 ("/dev/null")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
__GI__IO_fwrite (buf=buf@entry=0xacd440, size=size@entry=0x1, count=count@entry=0x10, fp=0xbebebebebebebebe)
at iofwrite.c:37
37 iofwrite.c: No such file or directory.
gdb-peda$ bt 10
#0 __GI__IO_fwrite (buf=buf@entry=0xacd440, size=size@entry=0x1, count=count@entry=0x10, fp=0xbebebebebebebebe)
at iofwrite.c:37
#1 0x000000000052d566 in HtmlOutputDev::~HtmlOutputDev (this=0x6110000098c0, __in_chrg=<optimized out>)
at /home/greydog/fuzz/poppler/utils/HtmlOutputDev.cc:1221
#2 0x000000000052d861 in HtmlOutputDev::~HtmlOutputDev (this=0x6110000098c0, __in_chrg=<optimized out>)
at /home/greydog/fuzz/poppler/utils/HtmlOutputDev.cc:1227
#3 0x0000000000505440 in main (argc=0x3, argc@entry=0x5, argv=argv@entry=0x7fffffffd7e8)
at /home/greydog/fuzz/poppler/utils/pdftohtml.cc:457
#4 0x00007ffff4787830 in __libc_start_main (main=0x503bf0 <main(int, char**)>, argc=0x5, argv=0x7fffffffd7e8,
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffd7d8)
at ../csu/libc-start.c:291
#5 0x0000000000508819 in _start ()
[----------------------------------registers-----------------------------------] [23/9786]
RAX: 0x0
RBX: 0xffffffffaa2 --> 0x0
RCX: 0x6110000098c0 --> 0xe3bf48 --> 0x52ce50 (<HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98])
RDX: 0xc2200001318 --> 0x0
RSI: 0xe3bf48 --> 0x52ce50 (<HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98])
RDI: 0x6110000098c0 --> 0xe3bf48 --> 0x52ce50 (<HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98])
RBP: 0x7fffffffd510 --> 0x41b58ab3
RSP: 0x7fffffffd458 --> 0x505440 (<main(int, char**)+6224>: mov DWORD PTR [rsp+0x18],0x0)
RIP: 0x52d820 (<HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98])
R8 : 0x1c77ea
R9 : 0x1c80b
R10: 0x6110000098c0 --> 0xe3bf48 --> 0x52ce50 (<HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98])
R11: 0x1c7856
R12: 0x60300001e730 --> 0x60300001e740 ("/dev/null")
R13: 0xef4140 --> 0x0
R14: 0x610000007d40 --> 0x603000001090 --> 0x6030000010a0 ("./in/poc")
R15: 0x603000001120 --> 0x603000001130 ("./in/poc")
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x52d810 <HtmlOutputDev::~HtmlOutputDev()+2496>: call 0x5007f0 <__stack_chk_fail@plt>
0x52d815 <HtmlOutputDev::~HtmlOutputDev()+2501>: call 0x501640 <__asan_report_load8@plt>
0x52d81a: nop WORD PTR [rax+rax*1+0x0]
=> 0x52d820 <HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98]
0x52d828 <HtmlOutputDev::~HtmlOutputDev()+8>: mov QWORD PTR [rsp],rdx
0x52d82c <HtmlOutputDev::~HtmlOutputDev()+12>: mov QWORD PTR [rsp+0x8],rcx
0x52d831 <HtmlOutputDev::~HtmlOutputDev()+17>: mov QWORD PTR [rsp+0x10],rax
0x52d836 <HtmlOutputDev::~HtmlOutputDev()+22>: mov rcx,0xee1
[------------------------------------stack-------------------------------------]
0x52d810 <HtmlOutputDev::~HtmlOutputDev()+2496>: call 0x5007f0 <__stack_chk_fail@plt>
0x52d815 <HtmlOutputDev::~HtmlOutputDev()+2501>: call 0x501640 <__asan_report_load8@plt>
0x52d81a: nop WORD PTR [rax+rax*1+0x0]
=> 0x52d820 <HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98]
0x52d828 <HtmlOutputDev::~HtmlOutputDev()+8>: mov QWORD PTR [rsp],rdx
0x52d82c <HtmlOutputDev::~HtmlOutputDev()+12>: mov QWORD PTR [rsp+0x8],rcx
0x52d831 <HtmlOutputDev::~HtmlOutputDev()+17>: mov QWORD PTR [rsp+0x10],rax
0x52d836 <HtmlOutputDev::~HtmlOutputDev()+22>: mov rcx,0xee1
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffd458 --> 0x505440 (<main(int, char**)+6224>: mov DWORD PTR [rsp+0x18],0x0)
0008| 0x7fffffffd460 --> 0x7ffff53d5ac8 (:wcout+8>: 0x00007ffff53d0a10)
0016| 0x7fffffffd468 --> 0x7fffffffd6d0 --> 0x0
0024| 0x7fffffffd470 --> 0x7fffffffd510 --> 0x41b58ab3
0032| 0x7fffffffd478 --> 0x6110000098c0 --> 0xe3bf48 --> 0x52ce50 (<HtmlOutputDev::~HtmlOutputDev()>: lea rsp,[rsp-0x98])
0040| 0x7fffffffd480 --> 0xef3fc0 --> 0x0
0048| 0x7fffffffd488 --> 0x60300001e250 --> 0x60307a800001 --> 0x0
0056| 0x7fffffffd490 --> 0x60300001e1f0 --> 0x60607b800002 --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Breakpoint 1, HtmlOutputDev::~HtmlOutputDev (this=0x6110000098c0, __in_chrg=<optimized out>)
at /home/greydog/fuzz/poppler/utils/HtmlOutputDev.cc:1201
1201 HtmlOutputDev::~HtmlOutputDev() {
gdb-peda$ p page
$1 = (FILE *) 0xbebebebebebebebe
gdb-peda$ list
1196 delete htmlEncoding;
1197 }
1198 ok = true;
1199 }
1200
1201 HtmlOutputDev::~HtmlOutputDev() {
1202 delete Docname;
1203 delete docTitle;
1204
1205 for (auto entry : *glMetaVars) {