GNOME Bugzilla – Bug 751254
Null pointer crash in ms-excel-read.c:1284 on a fuzzed xls file
Last modified: 2015-06-20 15:57:03 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_004-ms-excel-read.c.1284.xls $ ssconvert gnumeric_case_004-ms-excel-read.c.1284.xls /tmp/out.gnumeric ==12218==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fdbed07a32a bp 0x7fff761c3ed0 sp 0x7fff761c3668 T0) #0 0x7fdbed07a329 in __GI_strlen (/usr/lib/libc.so.6+0x80329) #1 0x4ac2ad in __interceptor_strlen (apps/bin/ssconvert+0x4ac2ad) #2 0x7fdbce029cf6 in sst_read_string gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1284:16 #3 0x7fdbce01ea5d in excel_read_SST gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1330:12 #4 0x7fdbcdff582c in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7312:21 #5 0x7fdbcdf87441 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:170:4 #6 0x7fdbcdf88e94 in excel_file_open gnumeric/gnumeric/plugins/excel/boot.c:273:2 #7 0x7fdbf2be1e30 in go_plugin_loader_module_func_file_open gnumeric/goffice/goffice/app/go-plugin-loader-module.c:282:3 #8 0x7fdbf2bf59b4 in go_plugin_file_opener_open gnumeric/goffice/goffice/app/go-plugin-service.c:685:2 #9 0x7fdbf2c031c8 in go_file_opener_open gnumeric/goffice/goffice/app/file.c:417:2 #10 0x7fdbf458d34a in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278:3 #11 0x7fdbf458df40 in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337:9 #12 0x4e1031 in convert gnumeric/gnumeric/src/ssconvert.c:721:9 #13 0x4ded93 in main gnumeric/gnumeric/src/ssconvert.c:913:9 #14 0x7fdbed01a78f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #15 0x437c58 in _start (apps/bin/ssconvert+0x437c58) -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.