bugCompact Disc Input and Control Library - Bugs: bug #45016, Invalid free() in functions main()...

 
 

bug #45016: Invalid free() in functions main() and cdio_stream_destroy()

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Tue 05 May 2015 07:26:13 AM UTC  
 
Category: NoneSeverity: 5 - Average
Item Group: libcdioStatus: Fixed
Privacy: PublicAssigned to: Rocky Bernstein <rocky>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 08 May 2015 04:30:36 AM UTC, comment #3:

With commit 5e1e217, I believe this is now fixed.

Rocky Bernstein <rocky>
Project AdministratorIn charge of this item.
Fri 08 May 2015 03:43:37 AM UTC, comment #2:

Ok. I see how to reproduce now. As you mention in another report. One has to use the -f <inputfile> option.

Pro tip: When reporting a bug, always give the input you ran as well as the output produced. Giving command invocation should not be considered an afterthought, but part of the bug-reporting process.

Rocky Bernstein <rocky>
Project AdministratorIn charge of this item.
Fri 08 May 2015 03:32:27 AM UTC, comment #1:

I don't have a problem running iso-info both with 0.93 and the current git source on x86_64-unknown-linux-gnu

I also don't see:

++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order

My log is attached below.

(file #33964)

Rocky Bernstein <rocky>
Project AdministratorIn charge of this item.
Tue 05 May 2015 07:26:13 AM UTC, original submission:

Attached malformed iso file will cause an invalid free in libcdio.

There is one interesting observation about this sample: It will crash in different ways depending on the filename. If the file is named .iso the crash will happen in main(), if the file is named otherwise the crash will happen in cdio_stream_destroy().

Found with american fuzzy lop. I've attached address sanitizer output for both cases.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #33964:  libcdio-invalid-free.log added by rocky (2KiB - text/x-log)
file #33910:  libcdio-invalid-free.iso added by hanno (46KiB - application/x-cd-image)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rocky (Updated the item)
  • -unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 08 May 2015 04:30:36 AM UTCrockyStatusNone=>Fixed
      Assigned toNone=>rocky
      Open/ClosedOpen=>Closed
    Fri 08 May 2015 03:32:27 AM UTCrockyAttached File-=>Added libcdio-invalid-free.log, #33964
    Wed 06 May 2015 07:23:16 PM UTCrockyItem GroupNone=>libcdio
    Tue 05 May 2015 07:26:13 AM UTChannoAttached File-=>Added libcdio-invalid-free.iso, #33910
      Attached File-=>Added libcdio-invalid-free-no-iso-extension.asan.log, #33911
      Attached File-=>Added libcdio-invalid-free.iso.asan.txt, #33912

    Back to the top


    Powered by Savane 3.1-cleanup1