bugGNUstep Application Project - Bugs: bug #52736, [Cynthiune] Buffer overflow in the...

 
 

bug #52736: [Cynthiune] Buffer overflow in the ASFTags bundle

Submitted by:  Yavor Doganov <yavor>
Submitted on:  Sun 24 Dec 2017 02:56:23 PM UTC  
 
Category:  Application Severity:  3 - Normal
Item Group:  Bug Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 24 Dec 2017 02:56:23 PM UTC, original submission:  

On GNU/Linux x86_64, adding a .wma song leads to abort:

 Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51        ../sysdeps/unix/sysv/linux/raise.c: Няма такъв файл или директория.
(gdb) bt
#0  0x00007ffff5c94a70 in __GI_raise (sig=sig@entry=6)
    at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff5c9619a in __GI_abort () at abort.c:89
#2  0x00007ffff5cd3300 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff5dcdd30 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff5cd995e in malloc_printerr (action=3, str=0x7ffff5dcde40 "free(): invalid next size (fast)", ptr=<optimized out>, ar_ptr=<optimized out>)
    at malloc.c:5079
#4  0x00007ffff5cda1be in _int_free (av=0x7ffff5ffeb00 <main_arena>, p=0x555555f01c60, have_lock=0) at malloc.c:3875
#5  0x00007fffc66d7de7 in objectIsOfType (object=0x555556395160, GUID=0x7fffc66d8f88 "75B22630-668E-11CF-A6D9-00AA0062CE6C") at ASFTags.m:88
#6  0x00007fffc66d86c8 in readMetaData (asf=0x555556394f30) at ASFTags.m:304
#7  0x00007fffc66d8a55 in +[ASFTags readTitle:artist:album:trackNumber:genre:year:ofFilename:] (self=0x7fffc68da9e0 <_OBJC_Class_ASFTags>, _cmd=0x5555557b8800 <_OBJC_SELECTOR_TABLE+480>, title=0x55555638c7c8, artist=0x55555638c7d0, album=0x55555638c7d8, trackNumber=0x55555638c7f0, genre=0x55555638c7e0, year=0x55555638c7e8, filename=0x55555638c8c0) at ASFTags.m:392
#8  0x00005555555924a1 in -[Song _refreshSongInfos] (self=0x55555638c7b0, _cmd=0x5555557b8890 <_OBJC_SELECTOR_TABLE+624>) at Song.m:229
#9  0x00005555555926db in -[Song _readInfos] (self=0x55555638c7b0, _cmd=0x5555557b88d0 <_OBJC_SELECTOR_TABLE+688>) at Song.m:253
#10 0x0000555555593a29 in -[Song encodeWithCoder:] (self=0x55555638c7b0, _cmd=0x7ffff70bceb0 <_OBJC_SELECTOR_TABLE+496>, encoder=0x55555638c930) at Song.m:505
#11 0x00007ffff6bd69aa in -[NSKeyedArchiver(Private) _encodeObject:conditional:] (self=0x55555638c930, _cmd=<optimized out>, anObject=0x55555638c7b0, conditional=<optimized out>) at NSKeyedArchiver.m:352
#12 0x00007ffff6bd213e in -[NSKeyedArchiver(Internal) _encodeArrayOfObjects:forKey:] (self=0x55555638c930, _cmd=<optimized out>, anArray=0x555556461020, aKey=0x7ffff707dac0 <_OBJC_INSTANCE_3>) at NSKeyedArchiver.m:163
#13 0x00007ffff6b38485 in -[NSArray encodeWithCoder:] (self=0x555556461020, _cmd=<optimized out>, aCoder=0x55555638c930) at NSArray.m:448
#14 0x00007ffff6adf9ce in -[GSArray encodeWithCoder:] (self=0x555556461020, _cmd=<optimized out>, aCoder=0x55555638c930) at GSArray.m:174
#15 0x00007ffff6bd69aa in -[NSKeyedArchiver(Private) _encodeObject:conditional:] (self=0x55555638c930, _cmd=<optimized out>, anObject=0x555556461020, conditional=<optimized out>) at NSKeyedArchiver.m:352
#16 0x00007ffff6bd3bac in -[NSKeyedArchiver encodeObject:forKey:] (self=0x55555638c930, _cmd=<optimized out>, anObject=0x555556461020, aKey=0x7ffff70bdd70 <_OBJC_INSTANCE_10>) at NSKeyedArchiver.m:657
#17 0x00007ffff6bd4020 in +[NSKeyedArchiver archivedDataWithRootObject:] (self=<optimized out>, _cmd=<optimized out>, anObject=0x555556461020)
    at NSKeyedArchiver.m:447
#18 0x00007ffff6bd1b1e in +[NSKeyedArchiver archiveRootObject:toFile:] (self=0x7ffff70bd280 <_OBJC_Class_NSKeyedArchiver>, _cmd=<optimized out>, anObject=0x5555
56461020, aPath=0x55555645df50) at NSKeyedArchiver.m:469
#19 0x0000555555586b51 in -[Playlist saveToFile:] (self=0x55555645dee0, _cmd=0x5555557b2190 <_OBJC_SELECTOR_TABLE+2288>, file=0x55555645df50) at Playlist.m:608
#20 0x000055555558c83d in -[PlaylistController playlistChanged:] (self=0x55555645dfc0, _cmd=0x5555557adc00 <_OBJC_SELECTOR_TABLE+96>, aNotification=0x555557110730) at PlaylistController.m:1086
#21 0x00007ffff6bf4e1e in -[NSNotificationCenter _postAndRelease:] (self=0x5555558e9c80, _cmd=<optimized out>, notification=0x555557110730)
    at NSNotificationCenter.m:1199
#22 0x0000555555583fba in -[Playlist postNotificationWithSongAsFirst:] (self=0x55555645dee0, _cmd=0x5555557adc90 <_OBJC_SELECTOR_TABLE+240>, song=0x55555638c7b0) at Playlist.m:100
#23 0x0000555555584404 in -[Playlist addSongsInArray:] (self=0x55555645dee0, _cmd=0x5555557b1f70 <_OBJC_SELECTOR_TABLE+1744>, array=0x555555efc9e0)
    at Playlist.m:150
#24 0x0000555555589b2b in -[PlaylistController _feedPlaylistWithTreeOfFilenames:] (self=0x55555645dfc0, _cmd=0x5555557b1f30 <_OBJC_SELECTOR_TABLE+1680>, filenames=0x555555efc880) at PlaylistController.m:535
#25 0x0000555555589bde in -[PlaylistController _oPanelDidEnd:returnCode:contextInfo:] (self=0x55555645dfc0, _cmd=0x5555557b2050 <_OBJC_SELECTOR_TABLE+1968>, oPanel=0x55555723b400, result=1, contextInfo=0x0) at PlaylistController.m:546
#26 0x000055555558a142 in -[PlaylistController _runOpenPanelWithDidEndSelector:] (self=0x55555645dfc0, _cmd=0x5555557b2080 <_OBJC_SELECTOR_TABLE+2016>, selector=0x5555557b2050 <_OBJC_SELECTOR_TABLE+1968>) at PlaylistController.m:611
#27 0x000055555558a3b8 in -[PlaylistController addSongs:] (self=0x55555645dfc0, _cmd=0x5555557b1a10 <_OBJC_SELECTOR_TABLE+368>, sender=0x555556f66c30)
    at PlaylistController.m:636
#28 0x00007ffff7376272 in -[NSApplication sendAction:to:from:] (self=self@entry=0x5555559b2e30, _cmd=_cmd@entry=0x7ffff7898fa0 <_OBJC_SELECTOR_TABLE+2720>, aSelector=aSelector@entry=0x5555557b1a10 <_OBJC_SELECTOR_TABLE+368>, aTarget=0x55555645dfc0, sender=sender@entry=0x555556f66c30) at NSApplication.m:2249
#29 0x00007ffff742b094 in -[NSMenu performActionForItemAtIndex:] (self=0x555556f66b30, _cmd=<optimized out>, index=<optimized out>) at NSMenu.m:1330
#30 0x00007ffff743321a in -[NSMenuView _trackWithEvent:startingMenuView:] (self=0x555556f68800, _cmd=<optimized out>, event=0x555557247f80, mainWindowMenuView=0x0) at NSMenuView.m:1916
#31 0x00007ffff7433333 in -[NSMenuView trackWithEvent:] (self=0x555556f68800, _cmd=<optimized out>, event=0x555556f7fde0) at NSMenuView.m:1952
#32 0x00007ffff7433605 in -[NSMenuView mouseDown:] (self=0x555556f68800, _cmd=<optimized out>, theEvent=0x555556f7fde0) at NSMenuView.m:1994
#33 0x00007ffff74f6365 in -[NSWindow sendEvent:] (self=0x555556f67280, _cmd=<optimized out>, theEvent=0x555556f7fde0) at NSWindow.m:3924
#34 0x00007ffff737c574 in -[NSApplication run] (self=0x5555559b2e30, _cmd=<optimized out>) at NSApplication.m:1562
#35 0x00007ffff735d375 in NSApplicationMain (argc=<optimized out>, argv=<optimized out>) at Functions.m:91
#36 0x0000555555576f1a in main (argc=1, argv=0x7fffffffdea8) at main.m:27

There's a buffer overflow in convertGUID -- the size is 44 in this case and doesn't fit into the allocated string.  Increasing the size is not an option as the comparison in objectIsOfType will fail anyway.  Proposed patch attached.

Yavor Doganov <yavor>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #42713:  buffer-oveflow.patch added by yavor (1KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yavor (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-12-24 yavor Attached File- => Added buffer-oveflow.patch, #42713

    Back to the top


    Powered by Savane 3.5