GNOME Bugzilla – Bug 760546
Null pointer crash in ms-chart.c:3083 on a fuzzed xls file
Last modified: 2016-01-13 13:21:31 UTC
Git versions of gtk, glib, goffice, gnumeric, libgsf and libxml2. Test case: http://jutaky.com/fuzzing/gnumeric_case_015-ms-chart.c.3083.xls $ ssconvert gnumeric_case_015-ms-chart.c.3083.xls /tmp/out.gnumeric ==5538==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f176b09df1c bp 0x7ffd32109a10 sp 0x7ffd32109860 T0) #0 0x7f176b09df1b in xl_chart_read_end gnumeric/gnumeric/plugins/excel/ms-chart.c:3083:28 #1 0x7f176b07b96a in ms_excel_chart_read gnumeric/gnumeric/plugins/excel/ms-chart.c:3819:12 #2 0x7f176afee35d in excel_read_sheet gnumeric/gnumeric/plugins/excel/ms-excel-read.c:6912:4 #3 0x7f176afdfa4d in excel_read_BOF gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7143:4 #4 0x7f176afd4840 in excel_read_workbook gnumeric/gnumeric/plugins/excel/ms-excel-read.c:7234:3 #5 0x7f176afaff21 in excel_enc_file_open gnumeric/gnumeric/plugins/excel/boot.c:170:4 #6 0x7f177fec8ca2 in go_plugin_loader_module_func_file_open gnumeric/goffice/goffice/app/go-plugin-loader-module.c:282:3 #7 0x7f177fed1966 in go_plugin_file_opener_open gnumeric/goffice/goffice/app/go-plugin-service.c:685:2 #8 0x7f177fed5abc in go_file_opener_open gnumeric/goffice/goffice/app/file.c:417:2 #9 0x7f1780adb910 in workbook_view_new_from_input gnumeric/gnumeric/src/workbook-view.c:1278:3 #10 0x7f1780adbc8f in workbook_view_new_from_uri gnumeric/gnumeric/src/workbook-view.c:1337:9 #11 0x4dd2d5 in convert gnumeric/gnumeric/src/ssconvert.c:715:9 #12 0x4dc712 in main gnumeric/gnumeric/src/ssconvert.c:918:19 #13 0x7f177a87b60f in __libc_start_main (/usr/lib/libc.so.6+0x2060f) #14 0x41a6a8 in _start (apps/bin/ssconvert+0x41a6a8) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV gnumeric/gnumeric/plugins/excel/ms-chart.c:3083:28 in xl_chart_read_end -- Juha Kylmänen
This problem has been fixed in our software repository. The fix will go into the next software release. Once that release is available, you may want to check for a software upgrade provided by your Linux distribution.