GNOME Bugzilla – Bug 751920
Out-of-bounds read in ms-chart.c:3425 on a fuzzed xls file
Last modified: 2015-07-04 06:18:47 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_004-ms-chart.c.3425.xls $ ssconvert gnumeric_case_004-ms-chart.c.3425.xls /tmp/out.gnumeric ==31094==ERROR: AddressSanitizer: SEGV on unknown address 0x60c00073fa78 (pc 0x7f77f5715e56 bp 0x7fffb0140650 sp 0x7fffb0140040 T0) #0 0x7f77f5715e55 in xl_chart_import_trend_line gnumeric/gnumeric/plugins/excel/ms-chart.c:3425:26 #1 0x7f77f570ee25 in ms_excel_chart_read gnumeric/gnumeric/plugins/excel/ms-chart.c:3883:6 #2 0x7f77f5546ccd in excel_read_BOF gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7110:4 #3 0x7f77f5541bc5 in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7211:4 #4 0x7f77f54d5221 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:170:4 #5 0x7f77f54d6c74 in excel_file_open gnumeric/gnumeric/plugins/excel/boot.c:273:2 #6 0x7f781a12ee30 in go_plugin_loader_module_func_file_open gnumeric/goffice/goffice/app/go-plugin-loader-module.c:282:3 #7 0x7f781a1429b4 in go_plugin_file_opener_open gnumeric/goffice/goffice/app/go-plugin-service.c:685:2 #8 0x7f781a1501c8 in go_file_opener_open gnumeric/goffice/goffice/app/file.c:417:2 #9 0x7f781bacf874 in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278:3 #10 0x7f781bad0460 in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337:9 #11 0x4e1031 in convert gnumeric/gnumeric/src/ssconvert.c:721:9 #12 0x4ded93 in main gnumeric/gnumeric/src/ssconvert.c:913:9 #13 0x7f781456b78f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #14 0x437c58 in _start (apps/bin/ssconvert+0x437c58) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/gnumeric/plugins/excel/ms-chart.c:3425 xl_chart_import_trend_line -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.