Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 915196 - media-libs/audiofile: heap-buffer-overflow in FLAC.cpp:133:11
Summary: media-libs/audiofile: heap-buffer-overflow in FLAC.cpp:133:11
Status: CONFIRMED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [upstream]
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-05 07:17 UTC by Agostino Sarubbo
Modified: 2023-10-23 04:32 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
stacktrace (file_915196.txt,6.44 KB, text/plain)
2023-10-05 07:17 UTC, Agostino Sarubbo
no flags Details
testcase (11.crashes.wav,31.25 KB, audio/wav)
2023-10-05 07:17 UTC, Agostino Sarubbo
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2023-10-05 07:17:09 UTC
Created attachment 872145 [details]
stacktrace

All of us know that audiofile is in a particular situation.
Years ago I (and probably someone else too) reported a lot of security holes, that were partially fixed upstream.
Now seems that we are apply a debian patchset to fix reported vulnerabilities, so our version is a bit different from 'pure upstream' considering also that last commit upstream was 7 years ago.

So this issue occurs in the 0.3.6-r5 version that we have in the main tree and I did not test further version (like master, considering what said above)

I know that you know, but for completeness I should say that you can see the same error when you compile the package with -fsanitize=address, or if you don't like it, maybe valgrind will do the same or playing a bit with gdb should show up to the same conclusion.

I'm attaching the full log and the testcase.

The command to reproduce is:
sfinfo $TESTCASE
Comment 1 Agostino Sarubbo gentoo-dev 2023-10-05 07:17:29 UTC
Created attachment 872146 [details]
testcase
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-10-23 04:32:14 UTC
Maybe you could work on a patch? Or test with the Debian fork? Or report to Debian?