search

vpaesa / cxlsx_to_csv

Convert XLSX (Excel 2007) files to CSV
GNU General Public License v2.0
7 stars 5 forks source link

Memory leaks vulneribility in main when use calloc and mz_zip_extract_archive_file_to_heap #6

Open fantasyoung opened 5 years ago

fantasyoung commented 5 years ago

Test Version

dev version,git clone https://github.com/vpaesa/cxlsx_to_csv

Command and argument

./cxlsx_to_csv_test ./cxlsx_to_csv_test -if crash_sample -of test.csv

Crash Information

The output of cxlsx_to_csv with address sanitizer enabled

./cxlsx_to_csv_test ./cxlsx_to_csv_test -if crash_sample -of test.csv
=================================================================
==51423==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 41032 byte(s) in 1 object(s) allocated from:
    #0 0x7fa9f9e8b79a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x42d90a in main /home/dawn/cxlsx_to_csv-master/cxlsx_to_csv.c:772
    #2 0x7fa9f9a4982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Direct leak of 1751 byte(s) in 1 object(s) allocated from:
    #0 0x7fa9f9e8b602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x401d4f in def_alloc_func /home/dawn/cxlsx_to_csv-master/miniz.c:1010
    #2 0x4245aa in mz_zip_reader_extract_to_heap /home/dawn/cxlsx_to_csv-master/miniz.c:3704
    #3 0x42d791 in mz_zip_extract_archive_file_to_heap /home/dawn/cxlsx_to_csv-master/miniz.c:4873
    #4 0x42e005 in main /home/dawn/cxlsx_to_csv-master/cxlsx_to_csv.c:887
    #5 0x7fa9f9a4982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: 42783 byte(s) leaked in 2 allocation(s).

POC file

crash_sample.zip

CREDIT

pu!m,Huawei Weiran Labs