这是indexloc提供的服务,不要输入任何密码
Skip to content

Segfault with fuzzed file (aiff) #480

@tholin

Description

@tholin

Parsing the following file with the tagreader example results in a segfault
https://www.dropbox.com/s/gjqdqda48x1gti7/taglib_aiff_segfault.aif

$ gdb --args ~/repository/taglib/build/examples/tagreader taglib_aiff_segfault.aif 
GNU gdb (Gentoo 7.7.1 p1) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /home/cocobo/repository/taglib/build/examples/tagreader...done.
(gdb) r
Starting program: /home/cocobo/repository/taglib/build/examples/tagreader taglib_aiff_segfault.aif
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
******************** "taglib_aiff_segfault.aif" ********************
TagLib: RIFF::File::read() -- Chunk '' has invalid ID
TagLib: toNumber<T>() -- No data to convert. Returning 0.
TagLib: toNumber<T>() -- No data to convert. Returning 0.
TagLib: toNumber<T>() -- No data to convert. Returning 0.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7a5b693 in TagLib::toFloat80<(TagLib::Utils::ByteOrder)1> (v=..., offset=8)
    at /home/cocobo/repository/taglib/taglib/toolkit/tbytevector.cpp:284
284       ::memcpy(bytes, v.data() + offset, 10);
(gdb) bt full
#0  0x00007ffff7a5b693 in TagLib::toFloat80<(TagLib::Utils::ByteOrder)1> (v=..., offset=8)
    at /home/cocobo/repository/taglib/taglib/toolkit/tbytevector.cpp:284
        bytes = "\b\000\000\000\000\000\000\000\b"
        fraction = 140737488344464
        val = 0
        negative = false
        exponent = 0
#1  0x00007ffff7a51c62 in TagLib::ByteVector::toFloat80BE (this=0x7fffffffd6a0, offset=8)
    at /home/cocobo/repository/taglib/taglib/toolkit/tbytevector.cpp:848
No locals.
#2  0x00007ffff7ab71a6 in TagLib::RIFF::AIFF::Properties::read (this=0x6183d0, data=...)
    at /home/cocobo/repository/taglib/taglib/riff/aiff/aiffproperties.cpp:108
        sampleRate = <invalid float value>
#3  0x00007ffff7ab6776 in TagLib::RIFF::AIFF::Properties::Properties (this=0x6183d0, data=..., 
    style=TagLib::AudioProperties::Average) at /home/cocobo/repository/taglib/taglib/riff/aiff/aiffproperties.cpp:61
No locals.
#4  0x00007ffff7ab54bd in TagLib::RIFF::AIFF::File::read (this=0x617cd0, readProperties=true, 
    propertiesStyle=TagLib::AudioProperties::Average) at /home/cocobo/repository/taglib/taglib/riff/aiff/aifffile.cpp:139
        i = 0
#5  0x00007ffff7ab3bed in TagLib::RIFF::AIFF::File::File (this=0x617cd0, file=0x7fffffffde81 "taglib_aiff_segfault.aif", 
    readProperties=true, propertiesStyle=TagLib::AudioProperties::Average)
    at /home/cocobo/repository/taglib/taglib/riff/aiff/aifffile.cpp:67
No locals.
#6  0x00007ffff7b7bb3c in TagLib::FileRef::create (fileName=0x7fffffffde81 "taglib_aiff_segfault.aif", 
    readAudioProperties=true, audioPropertiesStyle=TagLib::AudioProperties::Average)
    at /home/cocobo/repository/taglib/taglib/fileref.cpp:269
        it = 
        ext = {_vptr.String = 0x7ffff7dce4f0 <vtable for TagLib::String+16>, static null = {
            _vptr.String = 0x7ffff7dce4f0 <vtable for TagLib::String+16>, 
            static null = <same as static member of an already seen type>, 
            static WCharByteOrder = TagLib::String::UTF16LE, d = 0x616af0}, 
          static WCharByteOrder = TagLib::String::UTF16LE, d = 0x617db0}
#7  0x00007ffff7b77e21 in TagLib::FileRef::FileRef (this=0x7fffffffd8d0, 
    fileName=0x7fffffffde81 "taglib_aiff_segfault.aif", readAudioProperties=true, 
    audioPropertiesStyle=TagLib::AudioProperties::Average) at /home/cocobo/repository/taglib/taglib/fileref.cpp:83
No locals.
#8  0x00000000004048a7 in main (argc=2, argv=0x7fffffffda58) at /home/cocobo/repository/taglib/examples/tagreader.cpp:41
        f = {_vptr.FileRef = 0x7ffff7dd0610 <vtable for TagLib::FileRef+16>, d = 0x404792 <main+34>}
        i = 1
#9  0x00007ffff6c77dc5 in __libc_start_main () from /lib64/libc.so.6
No symbol table info available.
#10 0x00000000004046a9 in _start ()
No symbol table info available.
(gdb) list
279         debug("toFloat80() - offset is out of range. Returning 0.");
280         return 0.0;
281       }
282
283       uchar bytes[10];
284       ::memcpy(bytes, v.data() + offset, 10);
285
286       if(ENDIAN == Utils::LittleEndian) {
287         std::swap(bytes[0], bytes[9]);
288         std::swap(bytes[1], bytes[8]);
(gdb) print v.size()
$1 = 0
(gdb) print offset
$2 = 8

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions