GNOME Bugzilla – Bug 751253
Segfault in ms-chart.c:1940 on a fuzzed xls file
Last modified: 2015-06-20 16:03:25 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_003-ms-chart.c.1940.xls $ ssconvert gnumeric_case_003-ms-chart.c.1940.xls /tmp/out.gnumeric ==9468==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000098 (pc 0x7fdb51d5332d bp 0x7ffc62ac7950 sp 0x7ffc62ac7700 T0) #0 0x7fdb51d5332c in xl_chart_read_trendlimits gnumeric/gnumeric/plugins/excel/ms-chart.c:1940:2 #1 0x7fdb51cbb4df in ms_excel_chart_read gnumeric/gnumeric/plugins/excel/ms-chart.c:3641:14 #2 0x7fdb51af4b5d in excel_read_BOF gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7098:4 #3 0x7fdb51aeecac in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7181:3 #4 0x7fdb51a82441 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:170:4 #5 0x7fdb51a83e94 in excel_file_open gnumeric/gnumeric/plugins/excel/boot.c:273:2 #6 0x7fdb766dce30 in go_plugin_loader_module_func_file_open gnumeric/goffice/goffice/app/go-plugin-loader-module.c:282:3 #7 0x7fdb766f09b4 in go_plugin_file_opener_open gnumeric/goffice/goffice/app/go-plugin-service.c:685:2 #8 0x7fdb766fe1c8 in go_file_opener_open gnumeric/goffice/goffice/app/file.c:417:2 #9 0x7fdb7808834a in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278:3 #10 0x7fdb78088f40 in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337:9 #11 0x4e1031 in convert gnumeric/gnumeric/src/ssconvert.c:721:9 #12 0x4ded93 in main gnumeric/gnumeric/src/ssconvert.c:913:9 #13 0x7fdb70b1578f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #14 0x437c58 in _start (apps/bin/ssconvert+0x437c58) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/gnumeric/plugins/excel/ms-chart.c:1940 xl_chart_read_trendlimits -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.