Description of the null pointer vulnerability in abc - 1.1

CVE-2025-45333

Version：1.1
Discoverer：WeiBin Qiu<24210240277@m.fudan.edu.cn>
Affected Component：base/abci/abcVerify.c,void Abc_NtkCecFraigPart,pMiterPart->pModel
Reference：https://github.com/berkeley-abc/abc/pull/383
Description：
NULL Pointer Dereference vulnerability in Abc_NtkCecFraigPart.
The NULL Dereference vulnerability happens in  void Abc_NtkCecFraigPart(), base/abci/abcVerify.c
How the NULL Pointer Dereference happens:
1. pMiterPart is set to NULL by pMiterPart = NULL;
2. When the following conditions are met:  RetValue == 0
3. Dereference of NULL variable pMiterPart->pModel in Abc_NtkVerifySimulatePattern( pMiterPart, pMiterPart->pModel );

void Abc_NtkCecFraigPart( Abc_Ntk_t * pNtk1, Abc_Ntk_t * pNtk2, int nSeconds, 
                                int nPartSize, int fVerbose )
{
    Prove_Params_t Params, * pParams = &Params;
    Abc_Ntk_t * pMiter, * pMiterPart;
    Abc_Obj_t * pObj;
    int i, RetValue, Status, nOutputs;
    ......

=>  Abc_NtkForEachPo( pMiter, pObj, i )
    {
=>      if ( Abc_ObjFanin0(pObj) == Abc_AigConst1(pMiter) )
        {
            if ( Abc_ObjFaninC0(pObj) ) // complemented -> const 0
                RetValue = 1;
            else
=>              RetValue = 0;
=>          pMiterPart = NULL;
        }
        else
        {
           ......
        }

        if ( RetValue == -1 )
        {
            ......
        }
        else if ( RetValue == 0 )
        {
=>          int * pSimInfo = Abc_NtkVerifySimulatePattern( pMiterPart, pMiterPart->pModel );
            ......
        }
        ......
    }
    ......
 }