GNOME Bugzilla – Bug 751909
Null pointer crash in ms-excel-read.c:1621 on a fuzzed xls file
Last modified: 2015-07-04 14:34:05 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_003-ms-excel-read.c.1621.xls $ ssconvert gnumeric_case_003-ms-excel-read.c.1621.xls /tmp/out.gnumeric ==5756==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6d12f02613 bp 0x7fff9acbbe10 sp 0x7fff9acbb560 T0) #0 0x7f6d12f02612 in excel_read_FONT gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1621:21 #1 0x7f6d12efbd1f in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7220:22 #2 0x7f6d12e8f221 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:170:4 #3 0x7f6d12e90c74 in excel_file_open gnumeric/gnumeric/plugins/excel/boot.c:273:2 #4 0x7f6d37ae8e30 in go_plugin_loader_module_func_file_open gnumeric/goffice/goffice/app/go-plugin-loader-module.c:282:3 #5 0x7f6d37afc9b4 in go_plugin_file_opener_open gnumeric/goffice/goffice/app/go-plugin-service.c:685:2 #6 0x7f6d37b0a1c8 in go_file_opener_open gnumeric/goffice/goffice/app/file.c:417:2 #7 0x7f6d39489854 in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278:3 #8 0x7f6d3948a440 in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337:9 #9 0x4e1031 in convert gnumeric/gnumeric/src/ssconvert.c:721:9 #10 0x4ded93 in main gnumeric/gnumeric/src/ssconvert.c:913:9 #11 0x7f6d31f2578f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #12 0x437c58 in _start (apps/bin/ssconvert+0x437c58) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/gnumeric/plugins/excel/ms-excel-read.c:1621 excel_read_FONT -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.