GNOME Bugzilla – Bug 752182
Segfault in go-format.c:6261 on a fuzzed xls file
Last modified: 2015-10-19 17:55:22 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_005-go-format.c.6261.xls $ ssconvert gnumeric_case_005-go-format.c.6261.xls /tmp/out.gnumeric ==22211==ERROR: AddressSanitizer: SEGV on unknown address 0x00087fff8006 (pc 0x7f4553713098 bp 0x7fffd4151ef0 sp 0x7fffd4151de0 T0) #0 0x7f4553713097 in go_format_as_XL gnumeric/goffice/goffice/utils/go-format.c:6261:9 #1 0x7f4555859f89 in xml_write_cell_and_position gnumeric/gnumeric/src/xml-sax-write.c:880:24 #2 0x7f4555858290 in cb_write_cell gnumeric/gnumeric/src/xml-sax-write.c:911:2 #3 0x7f4555185e6f in sheet_foreach_cell_in_range gnumeric/gnumeric/src/sheet.c:4002:12 #4 0x7f455584d899 in xml_write_cells gnumeric/gnumeric/src/xml-sax-write.c:919:2 #5 0x7f4555844be2 in xml_write_sheet gnumeric/gnumeric/src/xml-sax-write.c:1372:2 #6 0x7f4555841559 in xml_write_sheets gnumeric/gnumeric/src/xml-sax-write.c:1390:3 #7 0x7f455583c114 in gnm_xml_file_save_full gnumeric/gnumeric/src/xml-sax-write.c:1521:2 #8 0x7f455583aed6 in gnm_xml_file_save gnumeric/gnumeric/src/xml-sax-write.c:1555:2 #9 0x7f4552eb7c9f in go_file_saver_save_real gnumeric/goffice/goffice/app/file.c:577:2 #10 0x7f4552eacdca in go_file_saver_save gnumeric/goffice/goffice/app/file.c:848:2 #11 0x7f4555691613 in wbv_save_to_output gnumeric/gnumeric/src/workbook-view.c:1059:2 #12 0x7f4555692145 in wb_view_save_to_uri gnumeric/gnumeric/src/workbook-view.c:1093:3 #13 0x7f4555693c81 in wb_view_save_as gnumeric/gnumeric/src/workbook-view.c:1129:2 #14 0x4e8c81 in convert gnumeric/gnumeric/src/ssconvert.c:836:9 #15 0x4e49bc in main gnumeric/gnumeric/src/ssconvert.c:913:9 #16 0x7f454c17778f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #17 0x438a48 in _start (apps/bin/ssconvert+0x438a48) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/goffice/goffice/utils/go-format.c:6261 go_format_as_XL -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.