Closed LossyDragon closed 3 years ago
LossyDragon
commented
3 years ago The crash is coming from here https://github.com/libxmp/libxmp/blob/f0ececf9f0958c30da41ae509ee5f04407c6d8a7/src/loaders/it_load.c#L1063
The song name contains the following "Quality Time - Big Money Me" with come unknown characters between "M" and "e".
sezero
commented
3 years ago ifh.name is most possibly not nul-terminated. Maybe something like the following would fix this?
diff --git a/src/loaders/it_load.c b/src/loaders/it_load.c
index 6bba313..8cc9c33 100644
--- a/src/loaders/it_load.c
+++ b/src/loaders/it_load.c
@@ -1060,7 +1060,9 @@ static int it_load(struct module_data *m, HIO_HANDLE *f, const int start)
hio_read(&ifh.chpan, 64, 1, f);
hio_read(&ifh.chvol, 64, 1, f);
- strncpy(mod->name, (char *)ifh.name, XMP_NAME_SIZE);
+ memcpy(mod->name, ifh.name, sizeof(ifh.name));
+ /* sizeof(ifh.name) == 26, sizeof(mod->name) == 64. */
+ mod->name[sizeof(ifh.name)] = '\0';
mod->len = ifh.ordnum;
mod->ins = ifh.insnum;
mod->smp = ifh.smpnum;That appears to work :)
It plays and displays the following name "Quality Time - Big Money M"
LossyDragon
commented
3 years ago The first unknown character is an End of transmission char. And the other is an Data link escape
sezero
commented
3 years ago The first unknown character is an End of transmission char. And the other is an Data link escape
The file is broken, because the name field is not nul-terminated.
Look at struct it_file_header in loaders/it.h: The chars after 'M'
are from the fields starting with hilite_min, hence the garbage.
(That last 'e' seems like a coincidence to be human-readable.)
Affected module: http://futurecrew.com/skaven/song_files/qualityt_bmm.it
I managed to catch a crash with his modue using the latest commits up to https://github.com/libxmp/libxmp/commit/c39084e2aa0f943ed983ad0c8c72cb65044d49ef
I don't have much information at this time, but i'd figured to post about it to look into it more. The libs compiled for the current play store version of Xmp Android (libxmp 4.4.1) dont crash it. So it could be a change with libxmp or a compiler issue for android?
I see it scans to test modules, but crashes on/after "Warning: load format: Impulse Tracker'
Note: I have crashlytics for my personal test builds and its uploading crashes that its caused by linux-gate.so.1 (I don't havevdebug symbols uploaded so thats all the info its giving me).