GNOME Bugzilla – Bug 751969
Out-of-bounds read in ms-chart.c:2830 on a fuzzed xls file
Last modified: 2015-07-05 16:06:11 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_009-ms-chart.c.2830.xls $ ssconvert gnumeric_case_009-ms-chart.c.2830.xls /tmp/out.gnumeric ==5526==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7f1d20ef50d7 bp 0x7ffd2b439490 sp 0x7ffd2b4373a0 T0) #0 0x7f1d20ef50d6 in xl_chart_read_end gnumeric/gnumeric/plugins/excel/ms-chart.c:2830:22 #1 0x7f1d20e85ea3 in ms_excel_chart_read gnumeric/gnumeric/plugins/excel/ms-chart.c:3816:14 #2 0x7f1d20cbf161 in excel_read_BOF gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7116:4 #3 0x7f1d20cb9fd5 in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7219:4 #4 0x7f1d20c4d241 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:170:4 #5 0x7f1d20c4ec94 in excel_file_open gnumeric/gnumeric/plugins/excel/boot.c:273:2 #6 0x7f1d458a5f20 in go_plugin_loader_module_func_file_open gnumeric/goffice/goffice/app/go-plugin-loader-module.c:282:3 #7 0x7f1d458b9aa4 in go_plugin_file_opener_open gnumeric/goffice/goffice/app/go-plugin-service.c:685:2 #8 0x7f1d458c72b8 in go_file_opener_open gnumeric/goffice/goffice/app/file.c:417:2 #9 0x7f1d47246804 in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278:3 #10 0x7f1d472473f0 in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337:9 #11 0x4e1031 in convert gnumeric/gnumeric/src/ssconvert.c:721:9 #12 0x4ded93 in main gnumeric/gnumeric/src/ssconvert.c:913:9 #13 0x7f1d3fce478f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #14 0x437c58 in _start (apps/bin/ssconvert+0x437c58) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/gnumeric/plugins/excel/ms-chart.c:2830 xl_chart_read_end -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.