SIGABRT in TNEFFreeMapiProps

[evintila]

Command: "ytnef -v crash2" Output: Starting program: /usr/local/bin/ytnef -v crash2 Attempting to parse crash2... Corrupted file detected at ytnef.c : 546 Error in `/usr/local/bin/ytnef': free(): invalid next size (fast): 0x000000000060b9a0 ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffff786d7e5] /lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7ffff787637a] /lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7ffff787a53c] /usr/local/lib/libytnef.so.0(TNEFFreeMapiProps+0x92)[0x7ffff7bc4462] /usr/local/lib/libytnef.so.0(TNEFFree+0x148)[0x7ffff7bc46e8] /usr/local/bin/ytnef[0x401021] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffff7816830] /usr/local/bin/ytnef[0x401199] ======= Memory map: ======== 00400000-00406000 r-xp 00000000 08:01 829171 /usr/local/bin/ytnef 00606000-00607000 r--p 00006000 08:01 829171 /usr/local/bin/ytnef 00607000-00608000 rw-p 00007000 08:01 829171 /usr/local/bin/ytnef 00608000-00629000 rw-p 00000000 00:00 0 [heap] 7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0 7ffff0021000-7ffff4000000 ---p 00000000 00:00 0 7ffff75e0000-7ffff75f6000 r-xp 00000000 08:01 268090 /lib/x86_64-linux-gnu/libgcc_s.so.1 7ffff75f6000-7ffff77f5000 ---p 00016000 08:01 268090 /lib/x86_64-linux-gnu/libgcc_s.so.1 7ffff77f5000-7ffff77f6000 rw-p 00015000 08:01 268090 /lib/x86_64-linux-gnu/libgcc_s.so.1 7ffff77f6000-7ffff79b6000 r-xp 00000000 08:01 268052 /lib/x86_64-linux-gnu/libc-2.23.so 7ffff79b6000-7ffff7bb6000 ---p 001c0000 08:01 268052 /lib/x86_64-linux-gnu/libc-2.23.so 7ffff7bb6000-7ffff7bba000 r--p 001c0000 08:01 268052 /lib/x86_64-linux-gnu/libc-2.23.so 7ffff7bba000-7ffff7bbc000 rw-p 001c4000 08:01 268052 /lib/x86_64-linux-gnu/libc-2.23.so 7ffff7bbc000-7ffff7bc0000 rw-p 00000000 00:00 0 7ffff7bc0000-7ffff7bc8000 r-xp 00000000 08:01 785095 /usr/local/lib/libytnef.so.0.0.0 7ffff7bc8000-7ffff7dc7000 ---p 00008000 08:01 785095 /usr/local/lib/libytnef.so.0.0.0 7ffff7dc7000-7ffff7dc8000 r--p 00007000 08:01 785095 /usr/local/lib/libytnef.so.0.0.0 7ffff7dc8000-7ffff7dd7000 rw-p 00008000 08:01 785095 /usr/local/lib/libytnef.so.0.0.0 7ffff7dd7000-7ffff7dfd000 r-xp 00000000 08:01 268024 /lib/x86_64-linux-gnu/ld-2.23.so 7ffff7fd9000-7ffff7fdd000 rw-p 00000000 00:00 0 7ffff7ff6000-7ffff7ff7000 rw-p 00000000 00:00 0 7ffff7ff7000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar] 7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso] 7ffff7ffc000-7ffff7ffd000 r--p 00025000 08:01 268024 /lib/x86_64-linux-gnu/ld-2.23.so 7ffff7ffd000-7ffff7ffe000 rw-p 00026000 08:01 268024 /lib/x86_64-linux-gnu/ld-2.23.so 7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

Program received signal SIGABRT, Aborted. 0x00007ffff782b428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54

gdb call trace:

0 0x00007ffff782b428 in __GI_raise (sig=sig@entry=6)

at ../sysdeps/unix/sysv/linux/raise.c:54

1 0x00007ffff782d02a in __GI_abort () at abort.c:89

2 0x00007ffff786d7ea in __libc_message (do_abort=do_abort@entry=2,

fmt=fmt@entry=0x7ffff7986ed8 "*** Error in `%s': %s: 0x%s ***\n")
at ../sysdeps/posix/libc_fatal.c:175

3 0x00007ffff787637a in malloc_printerr (ar_ptr=, ptr=,

str=0x7ffff7986f50 "free(): invalid next size (fast)", action=3) at malloc.c:5006

4 _int_free (av=, p=, have_lock=0) at malloc.c:3867

5 0x00007ffff787a53c in __GI___libc_free (mem=) at malloc.c:2968

6 0x00007ffff7bc4462 in TNEFFreeMapiProps (p=p@entry=0x609730) at ytnef.c:980

7 0x00007ffff7bc4593 in TNEFFreeAttachment (p=p@entry=0x6096c0) at ytnef.c:971

8 0x00007ffff7bc46e8 in TNEFFree (TNEF=TNEF@entry=0x7fffffffd930) at ytnef.c:958

9 0x0000000000401021 in main (argc=3, argv=0x7fffffffdcf8) at main.c:130

version 1.9.2, Ubuntu 16.04, gcc 5.4.0 found using afl crash2.zip

[ohwgiles]

I cannot reproduce this on latest master. Seems to be solved by #59

[Yeraze]

Released in https://github.com/Yeraze/ytnef/releases/tag/v1.9.3