GNOME Bugzilla – Bug 752180
Out-of-bounds read in position.c:260 on a fuzzed xls file
Last modified: 2015-10-17 19:03:46 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_003-position.c.260.xls $ ssconvert gnumeric_case_003-position.c.260.xls /tmp/out.gnumeric ==20976==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000021 (pc 0x7f9e73f114dc bp 0x7fff93e25450 sp 0x7fff93e25220 T0) #0 0x7f9e73f114db in parse_pos_init gnumeric/gnumeric/src/position.c:260:19 #1 0x7f9e4bc7b140 in excel_parse_name gnumeric/gnumeric/plugins/excel/ms-excel-read.c:3664:2 #2 0x7f9e4bc5c941 in excel_read_NAME gnumeric/gnumeric/plugins/excel/ms-excel-read.c:4010:11 #3 0x7f9e4bc27cf1 in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7285:22 #4 0x7f9e4bb9bbd7 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:170:4 #5 0x7f9e4bb9d6e4 in excel_file_open gnumeric/gnumeric/plugins/excel/boot.c:273:2 #6 0x7f9e71d4e333 in go_plugin_loader_module_func_file_open gnumeric/goffice/goffice/app/go-plugin-loader-module.c:282:3 #7 0x7f9e71d67d3f in go_plugin_file_opener_open gnumeric/goffice/goffice/app/go-plugin-service.c:685:2 #8 0x7f9e71d78d18 in go_file_opener_open gnumeric/goffice/goffice/app/file.c:417:2 #9 0x7f9e7456bf15 in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278:3 #10 0x7f9e7456cb00 in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337:9 #11 0x4e6f9f in convert gnumeric/gnumeric/src/ssconvert.c:720:9 #12 0x4e49bc in main gnumeric/gnumeric/src/ssconvert.c:913:9 #13 0x7f9e6b04b78f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #14 0x438a48 in _start (apps/bin/ssconvert+0x438a48) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/gnumeric/src/position.c:260 parse_pos_init -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.