GNOME Bugzilla – Bug 748597
Segfault in g_utf8_offset_to_pointer on a fuzzed xls file
Last modified: 2015-04-28 22:36:47 UTC
Git versions of gtk, glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_10926_24734.xls ssconvert gnumeric_case_10926_24734.xls /tmp/out.gnumeric ==5544==ERROR: AddressSanitizer: SEGV on unknown address 0x6020001c0000 (pc 0x7fcac743d5c9 sp 0x7ffc3c62dfe0 bp 0x7ffc3c62e000 T0) #0 0x7fcac743d5c8 in g_utf8_offset_to_pointer gnumeric/glib/glib/gutf8.c:349 #1 0x7fcaa89ae439 in sst_read_string gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1298 #2 0x7fcaa89aef5b in excel_read_SST gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1343 #3 0x7fcaa89ec990 in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7277 #4 0x7fcaa8985c38 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:193 #5 0x7fcaa8986517 in excel_file_open gnumeric/gnumeric/plugins/excel/boot.c:273 #6 0x7fcacd7e32df in go_plugin_loader_module_func_file_open app/go-plugin-loader-module.c:282 #7 0x7fcacd7e942a in go_plugin_file_opener_open app/go-plugin-service.c:685 #8 0x7fcacd7f1480 in go_file_opener_open app/file.c:417 #9 0x7fcace6ce4aa in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278 #10 0x7fcace6ce944 in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337 #11 0x4080cb in convert gnumeric/gnumeric/src/ssconvert.c:715 #12 0x409439 in main gnumeric/gnumeric/src/ssconvert.c:903 #13 0x7fcac6e107ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff) #14 0x4040f8 in _start (apps/bin/ssconvert+0x4040f8) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/glib/glib/gutf8.c:349 g_utf8_offset_to_pointer ==5544==ABORTING -- Juha Kylmänen
Valgrind agrees: ==2200== Invalid read of size 1 ==2200== at 0x8BABBA0: g_utf8_offset_to_pointer (in /usr/lib64/libglib-2.0.so.0.3800.2) ==2200== by 0x14AB5A47: sst_read_string (ms-excel-read.c:1298) ==2200== by 0x14AB5DB1: excel_read_SST (ms-excel-read.c:1343) ==2200== by 0x14AC9296: excel_read_workbook (ms-excel-read.c:7277) ==2200== by 0x14AA743D: excel_enc_file_open (boot.c:193) ==2200== by 0x14AA77AD: excel_file_open (boot.c:273) ==2200== by 0x541D53A: go_plugin_file_opener_open (go-plugin-service.c:685) ==2200== by 0x4F9BB1E: workbook_view_new_from_input (workbook-view.c:1278) ==2200== by 0x4F9BD6B: workbook_view_new_from_uri (workbook-view.c:1337) ==2200== by 0x404805: convert (ssconvert.c:715) ==2200== by 0x403AD6: main (ssconvert.c:903) ==2200== Address 0x14780741 is 0 bytes after a block of size 1 alloc'd ==2200== at 0x4C29B7E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2200== by 0x8B84D9E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) ==2200== by 0x14AB4E2A: excel_get_chars (ms-excel-read.c:1034) ==2200== by 0x14AB58FF: sst_read_string (ms-excel-read.c:1272) ==2200== by 0x14AB5DB1: excel_read_SST (ms-excel-read.c:1343) ==2200== by 0x14AC9296: excel_read_workbook (ms-excel-read.c:7277)
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.