Bug 702498 – Segfault on a corrupted (fuzzed) ods file in oo_legend

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 702498 - Segfault on a corrupted (fuzzed) ods file in oo_legend


Summary:	Segfault on a corrupted (fuzzed) ods file in oo_legend


Status:	RESOLVED FIXED

Product:	Gnumeric
Classification:	Applications
Component:	import/export OOo / OASIS
Version:	git master
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	Andreas J. Guelzow
QA Contact:	Jody Goldberg

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2013-06-17 18:07 UTC by jutaky
Modified:	2013-06-17 18:34 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description jutaky 2013-06-17 18:07:10 UTC

Segfault on a corrupted (fuzzed) ods file in oo_legend.

Git versions of glib, goffice, gnumeric, libgsf and libxml2.

Test case: http://jutaky.com/fuzzing/gnumeric_case_16199_6284.ods

Program received signal SIGSEGV, Segmentation fault.
0x00007fffe4751b06 in oo_legend (xin=0x7fffffffd400, attrs=0x91f240) at openoffice-read.c:9035
9035					odf_apply_style_props (xin, chart_style->style_props, style);
(gdb) bt

+ Trace 232083

#0 oo_legend
at openoffice-read.c line 9035
#1 push_child
at gsf-libxml.c line 648
#2 lookup_child
at gsf-libxml.c line 684
#3 gsf_xml_in_start_element
at gsf-libxml.c line 758
#4 xmlParseStartTag__internal_alias
at parser.c line 8612
#5 xmlParseElement__internal_alias
at parser.c line 9975
#6 xmlParseContent__internal_alias
at parser.c line 9885
#7 xmlParseElement__internal_alias
at parser.c line 10058
#8 xmlParseContent__internal_alias
at parser.c line 9885
#9 xmlParseElement__internal_alias
at parser.c line 10058
#10 xmlParseContent__internal_alias
at parser.c line 9885
#11 xmlParseElement__internal_alias
at parser.c line 10058
#12 xmlParseContent__internal_alias
at parser.c line 9885
#13 xmlParseElement__internal_alias
at parser.c line 10058
#14 xmlParseDocument__internal_alias
at parser.c line 10742
#15 gsf_xml_in_doc_parse
at gsf-libxml.c line 1280
#16 od_draw_object
at openoffice-read.c line 7743
#17 push_child
at gsf-libxml.c line 648
#18 lookup_child
at gsf-libxml.c line 684
#19 gsf_xml_in_start_element
at gsf-libxml.c line 758
#20 xmlParseStartTag__internal_alias
at parser.c line 8612
#21 xmlParseElement__internal_alias
at parser.c line 9975
#22 xmlParseContent__internal_alias
at parser.c line 9885
#23 xmlParseElement__internal_alias
at parser.c line 10058
#24 xmlParseContent__internal_alias
at parser.c line 9885
#25 xmlParseElement__internal_alias
at parser.c line 10058
#26 xmlParseContent__internal_alias
at parser.c line 9885
#27 xmlParseElement__internal_alias
at parser.c line 10058
#28 xmlParseContent__internal_alias
at parser.c line 9885
#29 xmlParseElement__internal_alias
at parser.c line 10058
#30 xmlParseContent__internal_alias
at parser.c line 9885
#31 xmlParseElement__internal_alias
at parser.c line 10058
#32 xmlParseContent__internal_alias
at parser.c line 9885
#33 xmlParseElement__internal_alias
at parser.c line 10058
#34 xmlParseContent__internal_alias
at parser.c line 9885
#35 xmlParseElement__internal_alias
at parser.c line 10058
#36 xmlParseDocument__internal_alias
at parser.c line 10742
#37 gsf_xml_in_doc_parse
at gsf-libxml.c line 1280
#38 openoffice_file_open
at openoffice-read.c line 12039
#39 go_plugin_loader_module_func_file_open
at app/go-plugin-loader-module.c line 282
#40 go_plugin_file_opener_open
at app/go-plugin-service.c line 685
#41 go_file_opener_open
at app/file.c line 417
#42 workbook_view_new_from_input
at workbook-view.c line 1272
#43 workbook_view_new_from_uri
at workbook-view.c line 1332
#44 main
at main-application.c line 321


--
Juha Kylmänen
Research Assistant, OUSPG

Comment 1 Andreas J. Guelzow 2013-06-17 18:34:15 UTC

This problem has been fixed in the development version. The fix will be available in the next major software release. Thank you for your bug report.