Segfault with fuzzed file (aiff) #480

Closed
tholin opened this Issue Dec 30, 2014 · 1 comment

Comments

Projects
None yet
2 participants
@tholin

tholin commented Dec 30, 2014

Parsing the following file with the tagreader example results in a segfault
https://www.dropbox.com/s/gjqdqda48x1gti7/taglib_aiff_segfault.aif

$ gdb --args ~/repository/taglib/build/examples/tagreader taglib_aiff_segfault.aif 
GNU gdb (Gentoo 7.7.1 p1) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /home/cocobo/repository/taglib/build/examples/tagreader...done.
(gdb) r
Starting program: /home/cocobo/repository/taglib/build/examples/tagreader taglib_aiff_segfault.aif
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
******************** "taglib_aiff_segfault.aif" ********************
TagLib: RIFF::File::read() -- Chunk '' has invalid ID
TagLib: toNumber<T>() -- No data to convert. Returning 0.
TagLib: toNumber<T>() -- No data to convert. Returning 0.
TagLib: toNumber<T>() -- No data to convert. Returning 0.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7a5b693 in TagLib::toFloat80<(TagLib::Utils::ByteOrder)1> (v=..., offset=8)
    at /home/cocobo/repository/taglib/taglib/toolkit/tbytevector.cpp:284
284       ::memcpy(bytes, v.data() + offset, 10);
(gdb) bt full
#0  0x00007ffff7a5b693 in TagLib::toFloat80<(TagLib::Utils::ByteOrder)1> (v=..., offset=8)
    at /home/cocobo/repository/taglib/taglib/toolkit/tbytevector.cpp:284
        bytes = "\b\000\000\000\000\000\000\000\b"
        fraction = 140737488344464
        val = 0
        negative = false
        exponent = 0
#1  0x00007ffff7a51c62 in TagLib::ByteVector::toFloat80BE (this=0x7fffffffd6a0, offset=8)
    at /home/cocobo/repository/taglib/taglib/toolkit/tbytevector.cpp:848
No locals.
#2  0x00007ffff7ab71a6 in TagLib::RIFF::AIFF::Properties::read (this=0x6183d0, data=...)
    at /home/cocobo/repository/taglib/taglib/riff/aiff/aiffproperties.cpp:108
        sampleRate = <invalid float value>
#3  0x00007ffff7ab6776 in TagLib::RIFF::AIFF::Properties::Properties (this=0x6183d0, data=..., 
    style=TagLib::AudioProperties::Average) at /home/cocobo/repository/taglib/taglib/riff/aiff/aiffproperties.cpp:61
No locals.
#4  0x00007ffff7ab54bd in TagLib::RIFF::AIFF::File::read (this=0x617cd0, readProperties=true, 
    propertiesStyle=TagLib::AudioProperties::Average) at /home/cocobo/repository/taglib/taglib/riff/aiff/aifffile.cpp:139
        i = 0
#5  0x00007ffff7ab3bed in TagLib::RIFF::AIFF::File::File (this=0x617cd0, file=0x7fffffffde81 "taglib_aiff_segfault.aif", 
    readProperties=true, propertiesStyle=TagLib::AudioProperties::Average)
    at /home/cocobo/repository/taglib/taglib/riff/aiff/aifffile.cpp:67
No locals.
#6  0x00007ffff7b7bb3c in TagLib::FileRef::create (fileName=0x7fffffffde81 "taglib_aiff_segfault.aif", 
    readAudioProperties=true, audioPropertiesStyle=TagLib::AudioProperties::Average)
    at /home/cocobo/repository/taglib/taglib/fileref.cpp:269
        it = 
        ext = {_vptr.String = 0x7ffff7dce4f0 <vtable for TagLib::String+16>, static null = {
            _vptr.String = 0x7ffff7dce4f0 <vtable for TagLib::String+16>, 
            static null = <same as static member of an already seen type>, 
            static WCharByteOrder = TagLib::String::UTF16LE, d = 0x616af0}, 
          static WCharByteOrder = TagLib::String::UTF16LE, d = 0x617db0}
#7  0x00007ffff7b77e21 in TagLib::FileRef::FileRef (this=0x7fffffffd8d0, 
    fileName=0x7fffffffde81 "taglib_aiff_segfault.aif", readAudioProperties=true, 
    audioPropertiesStyle=TagLib::AudioProperties::Average) at /home/cocobo/repository/taglib/taglib/fileref.cpp:83
No locals.
#8  0x00000000004048a7 in main (argc=2, argv=0x7fffffffda58) at /home/cocobo/repository/taglib/examples/tagreader.cpp:41
        f = {_vptr.FileRef = 0x7ffff7dd0610 <vtable for TagLib::FileRef+16>, d = 0x404792 <main+34>}
        i = 1
#9  0x00007ffff6c77dc5 in __libc_start_main () from /lib64/libc.so.6
No symbol table info available.
#10 0x00000000004046a9 in _start ()
No symbol table info available.
(gdb) list
279         debug("toFloat80() - offset is out of range. Returning 0.");
280         return 0.0;
281       }
282
283       uchar bytes[10];
284       ::memcpy(bytes, v.data() + offset, 10);
285
286       if(ENDIAN == Utils::LittleEndian) {
287         std::swap(bytes[0], bytes[9]);
288         std::swap(bytes[1], bytes[8]);
(gdb) print v.size()
$1 = 0
(gdb) print offset
$2 = 8
@sbooth

This comment has been minimized.

Show comment
Hide comment
@sbooth

sbooth Dec 30, 2014

Contributor

We need to back port the check for an appropriate COMM chunk size from the taglib2 branch

Contributor

sbooth commented Dec 30, 2014

We need to back port the check for an appropriate COMM chunk size from the taglib2 branch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment