GNOME Bugzilla – Bug 702218
Gnumeric segfaults on exit in unlink_single_dep on a corrupted (fuzzed) ods file
Last modified: 2013-06-14 13:24:26 UTC
The file appears to open without issues, but on exit segfault occurs in unlink_single_dep. Git versions of glib, goffice, libgsf and gnumeric. Test case: http://jutaky.com/fuzzing/gnumeric_case_15701_118.ods Program received signal SIGSEGV, Segmentation fault. 0x00007ffff78d20e5 in unlink_single_dep (dep=0x8c29c0, pos=0x8c29e8, a=0x89af08) at dependent.c:907 907 single = g_hash_table_lookup (deps->single_hash, &lookup); (gdb) bt
+ Trace 232054
-- Juha Kylmänen Research Assistant, OUSPG
I cannot replicate this. It opens fine (with a bunch of warnings on the console) and exits without a seg fault. (This is with git versions of goffice, libgsf and gnumeric and glib version 2.30.)
Here is an alternative test case which I suspects hits the same bug: http://jutaky.com/fuzzing/gnumeric_case_15422_266.ods If it makes any difference, I am on Arch linux (64bit). Segfaults with nearly identical backtrace for me: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff78d20f5 in unlink_single_dep (dep=0x915fa0, pos=0x915fc8, a=0x896150) at dependent.c:907 907 single = g_hash_table_lookup (deps->single_hash, &lookup); (gdb) bt
+ Trace 232056
==31745== Invalid read of size 8 ==31745== at 0x4EE5D2E: unlink_single_dep (dependent.c:897) ==31745== by 0x4EE6A4B: link_unlink_expr_dep (dependent.c:924) ==31745== by 0x4EE6C0E: link_unlink_expr_dep (dependent.c:1056) ==31745== by 0x4EE739F: dependent_unlink (dependent.c:1529) ==31745== by 0x4EE7814: dependent_set_expr (dependent.c:412) ==31745== by 0x4F2E5D9: gnm_style_unlink_dependents (mstyle.c:1935) ==31745== by 0x4F7D859: rstyle_apply (sheet-style.c:318) ==31745== by 0x4F7DD8B: cell_tile_apply (sheet-style.c:939) ==31745== by 0x4F7DAD5: cell_tile_apply (sheet-style.c:1166) ==31745== by 0x4F7DAD5: cell_tile_apply (sheet-style.c:1166) ==31745== by 0x4F7DAD5: cell_tile_apply (sheet-style.c:1166) ==31745== by 0x4F7E707: sheet_style_set_range (sheet-style.c:1357) ==31745== by 0x4F7E9EB: sheet_style_shutdown (sheet-style.c:763) ==31745== by 0x4F4CC3C: gnm_sheet_finalize (sheet.c:4566) ==31745== by 0x8768657: g_object_unref (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x4F9329D: workbook_sheet_delete (workbook.c:1096) ==31745== by 0x4F943CF: workbook_dispose (workbook.c:154) ==31745== by 0x87685C3: g_object_unref (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x4FF8E8B: dialog_quit (dialog-quit.c:443) ==31745== by 0x87636FF: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877476F: ??? (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C6DB: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C871: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x6DD0D82: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6DD1408: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x87636FF: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877476F: ??? (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C2FA: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C871: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x6DCB5E4: gtk_accel_group_activate (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6DCCD7C: gtk_accel_groups_activate (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6FFAB47: gtk_window_activate_key (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6FFABD8: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6EB5FD8: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x87636FF: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x87744EF: ??? (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C2FA: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C871: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x6FDE37D: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6EB41B4: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== Address 0x131bbf00 is 400 bytes inside a block of size 488 free'd ==31745== at 0x4C29D4E: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==31745== by 0x8783944: g_type_free_instance (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x4F9329D: workbook_sheet_delete (workbook.c:1096) ==31745== by 0x4F943CF: workbook_dispose (workbook.c:154) ==31745== by 0x87685C3: g_object_unref (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x4FF8E8B: dialog_quit (dialog-quit.c:443) ==31745== by 0x87636FF: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877476F: ??? (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C6DB: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C871: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x6DD0D82: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6DD1408: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x87636FF: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877476F: ??? (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C2FA: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C871: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x6DCB5E4: gtk_accel_group_activate (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6DCCD7C: gtk_accel_groups_activate (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6FFAB47: gtk_window_activate_key (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6FFABD8: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6EB5FD8: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x87636FF: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x87744EF: ??? (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C2FA: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x877C871: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.3200.4) ==31745== by 0x6FDE37D: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6EB41B4: ??? (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x6EB5CB2: gtk_main_do_event (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x7407621: ??? (in /usr/lib64/libgdk-3.so.0.400.4) ==31745== by 0x89EB3B4: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3200.4) ==31745== by 0x89EB6E7: ??? (in /usr/lib64/libglib-2.0.so.0.3200.4) ==31745== by 0x89EBAE1: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3200.4) ==31745== by 0x6EB5074: gtk_main (in /usr/lib64/libgtk-3.so.0.400.4) ==31745== by 0x403B2D: main (main-application.c:383)
This actually was a dependency tracking problem related to conditional styling. This problem has been fixed in our software repository. The fix will go into the next software release. Thank you for your bug report.