dbry / WavPack

WavPack encode/decode library, command-line programs, and several plugins
BSD 3-Clause "New" or "Revised" License
371 stars 67 forks source link

NULL dereference crash in pack_streams() #43

Closed jchoi2022 closed 6 years ago

jchoi2022 commented 6 years ago

Running wavpack with the attached file raises a segmentation fault error as follow. The bug seems to be a NULL dereference bug in pack_streams function.

jason@debian-amd64-stretch:~/report/source-latest/wavpack$ gdb WavPack/cli/wavpack -q
Reading symbols from WavPack/cli/wavpack...done.
(gdb) run poc-null-pack.wav
Starting program: /home/jason/report/source-latest/wavpack/WavPack/cli/wavpack poc-null-pack.wav

 WAVPACK  Hybrid Lossless Audio Compressor  Linux Version 5.1.0
 Copyright (c) 1998 - 2018 David Bryant.  All Rights Reserved.

warning: DSF file has partial-byte leftover samples!
warning: DSF file has non-integer bytes/second!
   0% done...
Program received signal SIGSEGV, Segmentation fault.
0x000000000041c8c9 in pack_streams (wpc=<optimized out>, block_samples=<optimized out>) at pack_utils.c:915
915         max_blocksize = block_samples * max_chans * ((wpc->streams [0]->wphdr.flags & BYTES_STORED) + 1);
(gdb) where
#0  0x000000000041c8c9 in pack_streams (wpc=<optimized out>, block_samples=<optimized out>) at pack_utils.c:915
#1  0x000000000041c4d3 in WavpackPackSamples (wpc=<optimized out>, sample_buffer=<optimized out>, sample_count=<optimized out>) at pack_utils.c:677
#2  0x00000000004082ad in pack_dsd_audio (wpc=<optimized out>, infile=<optimized out>, qmode=<optimized out>, new_order=<optimized out>, md5_digest_source=<optimized out>)
    at wavpack.c:2515
#3  pack_file (infilename=<optimized out>, outfilename=<optimized out>, out2filename=<optimized out>, config=<optimized out>) at wavpack.c:1890
#4  0x0000000000403cf0 in main (argc=<optimized out>, argv=<optimized out>) at wavpack.c:1273
(gdb) x/i $rip
=> 0x41c8c9 <pack_streams+89>:  mov    (%rbx),%rcx
(gdb) info reg rbx
rbx            0x0      0

poc-null-pack.zip

Thank you.

dbry commented 6 years ago

Thanks for find and posting this...should be fixed in master