search

libgme / game-music-emu

Blargg's video game music emulation library, which allows audio applications to easily add playback support for the music of many classic video game consoles.
GNU Lesser General Public License v2.1
68 stars 12 forks source link

AddressSanitizer: negative-size-param: (size=-8), size=-8 passed to memcpy in Mem_File_Reader::read_avail #16

Closed Wohlstand closed 6 years ago

Wohlstand commented 6 years ago

Original report by Sebastian Dröge (Bitbucket: [Sebastian Dröge](https://bitbucket.org/Sebastian Dröge), ).

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883691#44

The file in question that causes the crash can be found here: https://bugs.debian.org/cgi-bin/bugreport.cgi?att=2;bug=883691;filename=poc-2.crash;msg=35

Wohlstand commented 6 years ago

Original comment by Sebastian Dröge (Bitbucket: [Sebastian Dröge](https://bitbucket.org/Sebastian Dröge), ).

The file in question

Crash can also be reproduced by running e.g. "ffplay" on the file, as long as ffmpeg is built with gme support (which is the case on e.g. Debian).

Wohlstand commented 6 years ago

Original comment by Michael Pyne (Bitbucket: mpyne, GitHub: mpyne).

Thanks, I'm taking a look tonight.

Wohlstand commented 6 years ago

Original comment by Michael Pyne (Bitbucket: mpyne, GitHub: mpyne).

I believe this is addressed by what will shortly become game-music-emu 0.6.2, containing a fix for what seems to be the precise issue, along with a minimal bit of additional hardening. If that is uncool for Debian packaging then I made sure to split out the smallest possible fix as a separate commit so it can be applied on its own if need be.

Note that I wasn't able to reproduce the precise issue on my system with the crasher file, but there was a useful backtrace in the linked information that seems to confirm the logic error upon inspection.

Wohlstand commented 6 years ago

Original comment by Michael Pyne (Bitbucket: mpyne, GitHub: mpyne).

The signed tarball for 0.6.2 is now available from the Downloads page. I believe this resolves the proximate issue (I suspect others will still lurk however!). But if you can still reproduce, please reopen.

Wohlstand commented 6 years ago

Original comment by Sebastian Dröge (Bitbucket: [Sebastian Dröge](https://bitbucket.org/Sebastian Dröge), ).

Thanks for the fast response!

From what I can see, you only fixed this issue and added some more checks (thanks!) but there don't seem to be any other functional changes. That should be fine

Wohlstand commented 6 years ago

Original comment by Sebastian Dröge (Bitbucket: [Sebastian Dröge](https://bitbucket.org/Sebastian Dröge), ).

Oh and I forgot to mention that I can confirm that this fixes this crash.