GNOME Bugzilla – Bug 705420
Segfault in gnm_sheet_get_size on a fuzzed ods file
Last modified: 2013-08-04 17:35:44 UTC
Segfault in gnm_sheet_get_size on a fuzzed ods file. Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_4031_36.ods Program received signal SIGSEGV, Segmentation fault. 0x00007ffff797a7a2 in gnm_sheet_get_size (sheet=0x7fff00000039) at sheet.c:6368 6368 if (G_UNLIKELY (sheet->being_constructed)) (gdb) bt
+ Trace 232335
-- Juha Kylmänen Research Assistant, OUSPG
I see: ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): CRITICAL **: sheet_cell_get: assertion `IS_SHEET (sheet)' failed ** (/home/aguelzow/gnumeric/bin/gnumeric:17470): WARNING **: Access to sheet size during construction! Program received signal SIGSEGV, Segmentation fault. 0xb7ceef28 in link_single_dep (dep=0x93bd950, pos=0xb7ed868c, ref=0x9371978) at dependent.c:878 878 single = g_hash_table_lookup (deps->single_hash, &lookup); (gdb) bt
+ Trace 232337
This all seems to come down on us not having a valid sheet...
Something seems to go wrong deep in dependent land... Breakpoint 1, gnm_go_data_set_sheet (dat=0x93bc270, sheet=0x896c150) at graph.c:249 249 GnmDependent *dep = gnm_go_data_get_dep (dat); (gdb) p *sheet $1 = {base = {g_type_instance = {g_class = 0x81ec980}, ref_count = 2, qdata = 0x0}, index_in_wb = 6, workbook = 0x8233428, being_invalidated = 0, being_constructed = 0, revive = 0x0, sheet_views = 0x8933260, name_quoted = 0x89761a8 "'Student Debt Chart'", name_unquoted = 0x896b530 "Student Debt Chart", name_unquoted_collate_key = 0x8976308 "VWXGHQWGHEWFKDUW\001", '\030' <repeats 16 times>, "\001\002\n\n\n\n\n\n\002\n\n\n\002\n\n\n\n\001\bӑ\005ӑ", name_case_insensitive = 0x8976348 "student debt chart", style_data = 0x896ba08, cols = { max_used = 1023, default_style = {size_pts = 60.037795275590547, size_pixels = 80, is_default = 1, outline_level = 0, is_collapsed = 0, hard_size = 0, visible = 1, in_filter = 0, in_advanced_filter = 0, needs_respan = 0, spans = 0x0}, info = 0x89332a8, max_outline_level = 0}, rows = {max_used = 0, default_style = {size_pts = 14.995275590551183, size_pixels = 20, is_default = 1, outline_level = 0, is_collapsed = 0, hard_size = 0, visible = 1, in_filter = 0, in_advanced_filter = 0, needs_respan = 0, spans = 0x0}, info = 0x8933580, max_outline_level = 0}, cell_hash = 0x8958690, names = 0x896b550, last_zoom_factor_used = 1, rendered_values = 0x896b560, sheet_objects = 0x0, max_object_extent = {col = 0, row = 0}, convs = 0x81d9200, display_formulas = 0, hide_zero = 0, hide_grid = 0, hide_col_header = 0, hide_row_header = 0, is_protected = 0, protected_allow = {edit_objects = 0, edit_scenarios = 0, cell_formatting = 0, column_formatting = 0, row_formatting = 0, insert_columns = 0, insert_rows = 0, insert_hyperlinks = 0, delete_columns = 0, delete_rows = 0, select_locked_cells = 1, sort_ranges = 0, edit_auto_filters = 0, edit_pivottable = 0, select_unlocked_cells = 1}, visibility = GNM_SHEET_VISIBILITY_VISIBLE, display_outlines = 1, outline_symbols_below = 1, outline_symbols_right = 1, text_is_rtl = 0, has_filtered_rows = 0, solver_parameters = 0x85262a0, scenarios = 0x0, sort_setups = 0x0, simulation_round = 0, deps = 0x896bf58, slicers = 0x0, filters = 0x0, list_merged = 0x0, hash_merged = 0x8958658, priv = 0x896b4b8, print_info = 0x896bcf8, tab_color = 0x0, tab_text_color = 0x0, sheet_type = GNM_SHEET_DATA, size = {max_cols = 1024, max_rows = 128}, tile_top_level = 3} (gdb) n 251 if (dep == NULL) (gdb) 254 if (dependent_is_linked (dep)) { (gdb) 259 if (sheet == NULL) (gdb) 264 if (dep->texpr == NULL) { (gdb) 277 dep->sheet = NULL; (gdb) 278 dependent_set_sheet (dep, sheet); (gdb) s dependent_set_sheet (dep=0x93bc288, sheet=0x896c150) at dependent.c:448 448 g_return_if_fail (dep != NULL); (gdb) 449 g_return_if_fail (dep->sheet == NULL); (gdb) 450 g_return_if_fail (!dependent_is_linked (dep)); (gdb) 452 dep->sheet = sheet; (gdb) 453 if (dep->texpr) { (gdb) 454 dependent_link (dep); (gdb) dependent_link (dep=0x93bc288) at dependent.c:1495 1495 g_return_if_fail (dep != NULL); (gdb) 1496 g_return_if_fail (dep->texpr != NULL); (gdb) 1497 g_return_if_fail (!(dep->flags & DEPENDENT_IS_LINKED)); (gdb) 1498 g_return_if_fail (IS_SHEET (dep->sheet)); (gdb) gnm_sheet_get_type () at sheet.c:1100 1100 GSF_CLASS (GnmSheet, gnm_sheet, (gdb) dependent_link (dep=0x93bc288) at dependent.c:1499 1499 g_return_if_fail (dep->sheet->deps != NULL); (gdb) 1501 sheet = dep->sheet; (gdb) 1504 dep->prev_dep = sheet->deps->tail; (gdb) n 1505 dep->next_dep = NULL; (gdb) 1506 if (dep->prev_dep) (gdb) 1509 sheet->deps->head = dep; /* first element */ (gdb) 1510 sheet->deps->tail = dep; (gdb) 1511 dep->flags |= DEPENDENT_IS_LINKED | (gdb) 1513 dep->texpr->expr, TRUE); (gdb) 1512 link_unlink_expr_dep (eval_pos_init_dep (&ep, dep), (gdb) ** (/home/aguelzow/gnumeric/bin/gnumeric:4611): WARNING **: Access to sheet size during construction! Program received signal SIGSEGV, Segmentation fault. 0xb7cef008 in link_single_dep (dep=0x93bc288, pos=0xb7ed876c, ref=0x9373978) at dependent.c:878 878 single = g_hash_table_lookup (deps->single_hash, &lookup); (gdb)
==5998== Conditional jump or move depends on uninitialised value(s) ==5998== at 0x16C599BC: oo_rangeref_parse (openoffice-read.c:1434) ==5998== by 0x16C5A0BB: odf_parse_range_address_or_expr (openoffice-read.c:2055) ==5998== by 0x16C5AD77: oo_plot_series (openoffice-read.c:8603) ==5998== by 0x6B7A938: lookup_child (gsf-libxml.c:684) ==5998== by 0x6B7AD06: gsf_xml_in_start_element (gsf-libxml.c:758) ==5998== by 0x6DF1507: xmlParseStartTag (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFC907: xmlParseElement (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFB4D7: xmlParseContent (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFC812: xmlParseElement (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFB4D7: xmlParseContent (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFC812: xmlParseElement (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFB4D7: xmlParseContent (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFC812: xmlParseElement (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFB4D7: xmlParseContent (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFC812: xmlParseElement (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFB4D7: xmlParseContent (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFC812: xmlParseElement (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFD7E9: xmlParseDocument (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6B7C39A: gsf_xml_in_doc_parse (gsf-libxml.c:1280) ==5998== by 0x16C4984D: od_draw_object (openoffice-read.c:7719) ==5998== by 0x6B7A938: lookup_child (gsf-libxml.c:684) ==5998== by 0x6B7AD06: gsf_xml_in_start_element (gsf-libxml.c:758) ==5998== by 0x6DF1507: xmlParseStartTag (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFC907: xmlParseElement (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0) ==5998== by 0x6DFB4D7: xmlParseContent (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.0)
Thank you Morten! This problem has been fixed in the development version. The fix will be available in the next major software release. Thank you for your bug report.