GNOME Bugzilla – Bug 751970
Out-of-bounds read in go-format.c:6321 on a fuzzed xls file
Last modified: 2015-07-08 13:02:12 UTC
Git versions of glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_010-go-format.c.6321.xls $ ssconvert gnumeric_case_010-go-format.c.6321.xls /tmp/out.gnumeric ==8371==ERROR: AddressSanitizer: SEGV on unknown address 0x00073fff8001 (pc 0x7faa803869a5 bp 0x7ffc06510890 sp 0x7ffc06510680 T0) #0 0x7faa803869a4 in go_format_unref gnumeric/goffice/goffice/utils/go-format.c:6321:2 #1 0x7faa8161dd4b in value_release gnumeric/gnumeric/src/value.c:564:3 #2 0x7faa80c4ea67 in gnm_cell_cleanout gnumeric/gnumeric/src/cell.c:62:2 #3 0x7faa81305fcf in cell_free gnumeric/gnumeric/src/sheet.c:4257:2 #4 0x7faa812f4f99 in cb_remove_allcells gnumeric/gnumeric/src/sheet.c:4495:2 #5 0x7faa7ab1f9af in g_hash_table_foreach gnumeric/glib/glib/ghash.c:1607 #6 0x7faa812c13c6 in sheet_cell_foreach gnumeric/gnumeric/src/sheet.c:4089:2 #7 0x7faa812f431c in sheet_destroy_contents gnumeric/gnumeric/src/sheet.c:4549:2 #8 0x7faa8166ea49 in workbook_dispose gnumeric/gnumeric/src/workbook.c:169:3 #9 0x7faa7b03ca54 in g_object_unref gnumeric/glib/gobject/gobject.c:3137 #10 0x4e2be8 in convert gnumeric/gnumeric/src/ssconvert.c:841:3 #11 0x4ded93 in main gnumeric/gnumeric/src/ssconvert.c:913:9 #12 0x7faa7a12a78f in __libc_start_main (/usr/lib/libc.so.6+0x2078f) #13 0x437c58 in _start (apps/bin/ssconvert+0x437c58) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/goffice/goffice/utils/go-format.c:6321 go_format_unref -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.
*** Bug 752082 has been marked as a duplicate of this bug. ***