GNOME Bugzilla – Bug 751968
Out-of-bounds read in ms-excel-read.c:1287 on a fuzzed xls file
Last modified: 2015-07-05 16:06:06 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_011-ms-excel-read.c.1287.xls $ ssconvert gnumeric_case_011-ms-excel-read.c.1287.xls /tmp/out.gnumeric ==32173==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x7fd1eb6c65c6 bp 0x7ffe7d306150 sp 0x7ffe7d305a40 T0) #0 0x7fd1eb6c65c5 in sst_read_string gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1287:17 #1 0x7fd1eb6bb3e5 in excel_read_SST gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1334:12 #2 0x7fd1eb691dac in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7332:21 #3 0x7fd1eb624241 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:170:4 #4 0x7fd1eb625c94 in excel_file_open gnumeric/gnumeric/plugins/excel/boot.c:273:2 #5 0x7fd21027cf20 in go_plugin_loader_module_func_file_open gnumeric/goffice/goffice/app/go-plugin-loader-module.c:282:3 #6 0x7fd210290aa4 in go_plugin_file_opener_open gnumeric/goffice/goffice/app/go-plugin-service.c:685:2 #7 0x7fd21029e2b8 in go_file_opener_open gnumeric/goffice/goffice/app/file.c:417:2 #8 0x7fd211c1d804 in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278:3 #9 0x7fd211c1e3f0 in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337:9 #10 0x4e1031 in convert gnumeric/gnumeric/src/ssconvert.c:721:9 #11 0x4ded93 in main gnumeric/gnumeric/src/ssconvert.c:913:9 #12 0x7fd20a6bb78f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #13 0x437c58 in _start (apps/bin/ssconvert+0x437c58) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1287 sst_read_string -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.