search

Doom-Utils / deutex

WAD composer for Doom, Heretic, Hexen, and Strife
Other
61 stars 17 forks source link

segfault extracting zaub.wad #58

Open jmtd opened 6 years ago

jmtd commented 6 years ago 
$ deutex -png -xtract zaub.wad 
i AA99 Saving pictures as PNG (.png)
i EX00 Extracting entries from wad zaub.wad
i WR19 Reading WAD ./hexen.wad: (410 entries)
i WR19 Reading WAD zaub.wad:    (410 entries)
i ID10 PWAD entry identification...
Segmentation fault
$ deutex -version
DeuTex 5.1.0
$ sha1sum zaub.wad 
0301453c0b73e379766d8b0f530f58c2c29ffe7c  zaub.wad
jmtd commented 6 years ago

With an unstripped binary, version 5.1.0

$d -png -xtract zaub.wad 
i AA99 Saving pictures as PNG (.png)
i EX00 Extracting entries from wad zaub.wad
i WR19 Reading WAD ./hexen.wad: (410 entries)
i WR19 Reading WAD zaub.wad:    (410 entries)
i ID10 PWAD entry identification...
i PL05 Palette is Hexen
i EX10 Extracting levels...
i EX15 Extracting lumps...
E TX13 TEXTURE2: too many textures (1919895099/8192)
jmtd commented 6 years ago

there's a one-byte lump immediately before it

lswad zaub.wad  | grep -C1 TEXTURE2
ZAUBERER        1               65970
TEXTURE2        126             65971
BIGFONT         7513            66097
>>> wad = open("zaub.wad").read()
>>> t2 = wad[65971:65971+126]
>>> print t2
;Format of textures:
;TextureName    Width   Height
;*      PatchName       Xoffset Yoffset
POOT                    64      64
*       W_240           0       0
;End

oh yeah of course that's wrong, that's not the binary format expected but a source format.

jmtd commented 6 years ago

To confirm 5.1.1-1 (via debian) still segfaults on this input when stripped

andwj commented 6 years ago

This does not seem like a bug to me. The format is wildly wrong, so naturally Deutex barfs on it Chocolate-Hexen and Eureka would also barf on it.

jmtd commented 6 years ago

This does not seem like a bug to me. The format is wildly wrong, so naturally Deutex barfs on it Chocolate-Hexen and Eureka would also barf on it.

Yeah it should bail, but probably not segfault.

andwj commented 6 years ago

Yeah it should bail, but probably not segfault.

Ideally yes, but it requires validating the structures that Deutex reads from a wad, and there are many of them, so it becomes a huge task that nobody would enjoy doing (especially testing it all....)