GNOME Bugzilla – Bug 750857
Out-of-bounds read in openoffice-write.c on a fuzzed xls to ods conversion
Last modified: 2015-06-12 17:20:48 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_15172_4911.2ods.xls $ ssconvert gnumeric_case_15172_4911.2ods.xls /tmp/out.ods ==1302==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x7f7e7134ca63 bp 0x7fffafba4ff0 sp 0x7fffafba4460 T0) #0 0x7f7e7134ca62 in odf_write_cell gnumeric/gnumeric/plugins/openoffice/openoffice-write.c:3384:18 #1 0x7f7e713485bc in odf_write_content_rows gnumeric/gnumeric/plugins/openoffice/openoffice-write.c:3886:5 #2 0x7f7e7133e34c in odf_write_sheet gnumeric/gnumeric/plugins/openoffice/openoffice-write.c:3967:3 #3 0x7f7e712ba9bb in odf_write_content gnumeric/gnumeric/plugins/openoffice/openoffice-write.c:4969:3 #4 0x7f7e712b6c9d in openoffice_file_save_real gnumeric/gnumeric/plugins/openoffice/openoffice-write.c:8909:12 #5 0x7f7e712b81b6 in odf_file_save gnumeric/gnumeric/plugins/openoffice/openoffice-write.c:9014:2 #6 0x7f7e95e732aa in go_plugin_loader_module_func_file_save gnumeric/goffice/goffice/app/go-plugin-loader-module.c:366:2 #7 0x7f7e95e82b11 in go_plugin_file_saver_save gnumeric/goffice/goffice/app/go-plugin-service.c:948:2 #8 0x7f7e95e9cb74 in go_file_saver_save gnumeric/goffice/goffice/app/file.c:848:2 #9 0x7f7e97817053 in wbv_save_to_output gnumeric/gnumeric/src/workbook-view.c:1059:2 #10 0x7f7e97817adf in wb_view_save_to_uri gnumeric/gnumeric/src/workbook-view.c:1093:3 #11 0x7f7e978192c3 in wb_view_save_as gnumeric/gnumeric/src/workbook-view.c:1129:2 #12 0x4e29ec in convert gnumeric/gnumeric/src/ssconvert.c:831:9 #13 0x4decce in main gnumeric/gnumeric/src/ssconvert.c:903:9 #14 0x7f7e902ab78f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #15 0x437b98 in _start (apps/bin/ssconvert+0x437b98) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/gnumeric/plugins/openoffice/openoffice-write.c:3384 odf_write_cell -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.