{"action":"created","issue":{"url":"https://api.github.com/repos/dbry/WavPack/issues/32","repository_url":"https://api.github.com/repos/dbry/WavPack","labels_url":"https://api.github.com/repos/dbry/WavPack/issues/32/labels{/name}","comments_url":"https://api.github.com/repos/dbry/WavPack/issues/32/comments","events_url":"https://api.github.com/repos/dbry/WavPack/issues/32/events","html_url":"https://github.com/dbry/WavPack/issues/32","id":316625353,"number":32,"title":"WavPack crashes -- Heap buffer overwrite","user":{"login":"thuanpv","id":3669460,"avatar_url":"https://avatars2.githubusercontent.com/u/3669460?v=4","gravatar_id":"","url":"https://api.github.com/users/thuanpv","html_url":"https://github.com/thuanpv","followers_url":"https://api.github.com/users/thuanpv/followers","following_url":"https://api.github.com/users/thuanpv/following{/other_user}","gists_url":"https://api.github.com/users/thuanpv/gists{/gist_id}","starred_url":"https://api.github.com/users/thuanpv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thuanpv/subscriptions","organizations_url":"https://api.github.com/users/thuanpv/orgs","repos_url":"https://api.github.com/users/thuanpv/repos","events_url":"https://api.github.com/users/thuanpv/events{/privacy}","received_events_url":"https://api.github.com/users/thuanpv/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"dbry","id":5532227,"avatar_url":"https://avatars3.githubusercontent.com/u/5532227?v=4","gravatar_id":"","url":"https://api.github.com/users/dbry","html_url":"https://github.com/dbry","followers_url":"https://api.github.com/users/dbry/followers","following_url":"https://api.github.com/users/dbry/following{/other_user}","gists_url":"https://api.github.com/users/dbry/gists{/gist_id}","starred_url":"https://api.github.com/users/dbry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dbry/subscriptions","organizations_url":"https://api.github.com/users/dbry/orgs","repos_url":"https://api.github.com/users/dbry/repos","events_url":"https://api.github.com/users/dbry/events{/privacy}","received_events_url":"https://api.github.com/users/dbry/received_events","type":"User","site_admin":false},"assignees":[{"login":"dbry","id":5532227,"avatar_url":"https://avatars3.githubusercontent.com/u/5532227?v=4","gravatar_id":"","url":"https://api.github.com/users/dbry","html_url":"https://github.com/dbry","followers_url":"https://api.github.com/users/dbry/followers","following_url":"https://api.github.com/users/dbry/following{/other_user}","gists_url":"https://api.github.com/users/dbry/gists{/gist_id}","starred_url":"https://api.github.com/users/dbry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dbry/subscriptions","organizations_url":"https://api.github.com/users/dbry/orgs","repos_url":"https://api.github.com/users/dbry/repos","events_url":"https://api.github.com/users/dbry/events{/privacy}","received_events_url":"https://api.github.com/users/dbry/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-04-23T00:04:40Z","updated_at":"2018-04-26T13:37:42Z","closed_at":"2018-04-26T13:37:42Z","author_association":"NONE","body":"Dear all,\r\n\r\nThis bug was found with AFLSmart, an extension of AFL. Thanks also to Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu. This could lead to denial of service and potentially code execution.\r\n\r\nThis bug was found on Ubuntu 16.04 64-bit & WavPack revision 0a7295 (HEAD)\r\n\r\nTo reproduce:\r\nDownload & extract the attached file - wavpack_crash4.wav\r\nwavpack -y wavpack_crash4.wav\r\n\r\nError message:\r\n\r\n```\r\n WAVPACK  Hybrid Lossless Audio Compressor  Linux Version 5.1.0\r\n Copyright (c) 1998 - 2017 David Bryant.  All Rights Reserved.\r\n\r\ncreating wavpack_crash4.wv,   0% done...*** Error in `../WavPack/cli/wavpack': munmap_chunk(): invalid pointer: 0x00000000009943f0 ***\r\n======= Backtrace: =========\r\n/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fbcb17db7e5]\r\n/lib/x86_64-linux-gnu/libc.so.6(cfree+0x1a8)[0x7fbcb17e8698]\r\n../WavPack/cli/wavpack[0x49080c]\r\n../WavPack/cli/wavpack[0x4a0051]\r\n../WavPack/cli/wavpack[0x4ace6d]\r\n../WavPack/cli/wavpack[0x434406]\r\n../WavPack/cli/wavpack[0x407443]\r\n/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fbcb1784830]\r\n../WavPack/cli/wavpack[0x416bf9]\r\n======= Memory map: ========\r\n00400000-00536000 r-xp 00000000 08:02 74187737                           /home/thuan/subjects/WavPack/cli/wavpack\r\n00736000-00737000 r--p 00136000 08:02 74187737                           /home/thuan/subjects/WavPack/cli/wavpack\r\n00737000-00738000 rw-p 00137000 08:02 74187737                           /home/thuan/subjects/WavPack/cli/wavpack\r\n0088a000-009b2000 rw-p 00000000 00:00 0                                  [heap]\r\n7fbcb154d000-7fbcb1563000 r-xp 00000000 08:02 70654120                   /lib/x86_64-linux-gnu/libgcc_s.so.1\r\n7fbcb1563000-7fbcb1762000 ---p 00016000 08:02 70654120                   /lib/x86_64-linux-gnu/libgcc_s.so.1\r\n7fbcb1762000-7fbcb1763000 r--p 00015000 08:02 70654120                   /lib/x86_64-linux-gnu/libgcc_s.so.1\r\n7fbcb1763000-7fbcb1764000 rw-p 00016000 08:02 70654120                   /lib/x86_64-linux-gnu/libgcc_s.so.1\r\n7fbcb1764000-7fbcb1924000 r-xp 00000000 08:02 70648185                   /lib/x86_64-linux-gnu/libc-2.23.so\r\n7fbcb1924000-7fbcb1b24000 ---p 001c0000 08:02 70648185                   /lib/x86_64-linux-gnu/libc-2.23.so\r\n7fbcb1b24000-7fbcb1b28000 r--p 001c0000 08:02 70648185                   /lib/x86_64-linux-gnu/libc-2.23.so\r\n7fbcb1b28000-7fbcb1b2a000 rw-p 001c4000 08:02 70648185                   /lib/x86_64-linux-gnu/libc-2.23.so\r\n7fbcb1b2a000-7fbcb1b2e000 rw-p 00000000 00:00 0 \r\n7fbcb1b2e000-7fbcb1c36000 r-xp 00000000 08:02 70648131                   /lib/x86_64-linux-gnu/libm-2.23.so\r\n7fbcb1c36000-7fbcb1e35000 ---p 00108000 08:02 70648131                   /lib/x86_64-linux-gnu/libm-2.23.so\r\n7fbcb1e35000-7fbcb1e36000 r--p 00107000 08:02 70648131                   /lib/x86_64-linux-gnu/libm-2.23.so\r\n7fbcb1e36000-7fbcb1e37000 rw-p 00108000 08:02 70648131                   /lib/x86_64-linux-gnu/libm-2.23.so\r\n7fbcb1e37000-7fbcb1e5d000 r-xp 00000000 08:02 70648018                   /lib/x86_64-linux-gnu/ld-2.23.so\r\n7fbcb204c000-7fbcb2050000 rw-p 00000000 00:00 0 \r\n7fbcb205b000-7fbcb205c000 rw-p 00000000 00:00 0 \r\n7fbcb205c000-7fbcb205d000 r--p 00025000 08:02 70648018                   /lib/x86_64-linux-gnu/ld-2.23.so\r\n7fbcb205d000-7fbcb205e000 rw-p 00026000 08:02 70648018                   /lib/x86_64-linux-gnu/ld-2.23.so\r\n7fbcb205e000-7fbcb205f000 rw-p 00000000 00:00 0 \r\n7ffe40759000-7ffe4077a000 rw-p 00000000 00:00 0                          [stack]\r\n7ffe407a4000-7ffe407a6000 r--p 00000000 00:00 0                          [vvar]\r\n7ffe407a6000-7ffe407a8000 r-xp 00000000 00:00 0                          [vdso]\r\nffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]\r\nAborted\r\n\r\n```\r\nValgrind says:\r\n\r\n```\r\ncreating wavpack_crash4.wv,   0% done...==168858== Invalid write of size 2\r\n==168858==    at 0x4C868F: flush_word (write_words.c:502)\r\n==168858==    by 0x4C868F: send_words_lossless (write_words.c:405)\r\n==168858==    by 0x4854CB: pack_samples (pack.c:1159)\r\n==168858==    by 0x48F5F7: pack_block (pack.c:638)\r\n==168858==    by 0x4A0050: pack_streams (pack_utils.c:951)\r\n==168858==    by 0x4ACE6C: WavpackFlushSamples (pack_utils.c:701)\r\n==168858==    by 0x434405: pack_audio (wavpack.c:2393)\r\n==168858==    by 0x434405: pack_file (wavpack.c:1891)\r\n==168858==    by 0x407442: main (wavpack.c:1272)\r\n==168858==  Address 0x57a9b1c is 13,212 bytes inside a block of size 13,213 alloc'd\r\n==168858==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==168858==    by 0x49FF3D: pack_streams (pack_utils.c:928)\r\n==168858==    by 0x4ACE6C: WavpackFlushSamples (pack_utils.c:701)\r\n==168858==    by 0x434405: pack_audio (wavpack.c:2393)\r\n==168858==    by 0x434405: pack_file (wavpack.c:1891)\r\n==168858==    by 0x407442: main (wavpack.c:1272)\r\n==168858== \r\n==168858== Invalid write of size 2\r\n==168858==    at 0x4C2203: flush_word (write_words.c:502)\r\n==168858==    by 0x4C87CB: send_words_lossless (write_words.c:438)\r\n==168858==    by 0x4854CB: pack_samples (pack.c:1159)\r\n==168858==    by 0x48F5F7: pack_block (pack.c:638)\r\n==168858==    by 0x4A0050: pack_streams (pack_utils.c:951)\r\n==168858==    by 0x4ACE6C: WavpackFlushSamples (pack_utils.c:701)\r\n==168858==    by 0x434405: pack_audio (wavpack.c:2393)\r\n==168858==    by 0x434405: pack_file (wavpack.c:1891)\r\n==168858==    by 0x407442: main (wavpack.c:1272)\r\n==168858==  Address 0x57a9b20 is 3 bytes after a block of size 13,213 alloc'd\r\n==168858==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==168858==    by 0x49FF3D: pack_streams (pack_utils.c:928)\r\n==168858==    by 0x4ACE6C: WavpackFlushSamples (pack_utils.c:701)\r\n==168858==    by 0x434405: pack_audio (wavpack.c:2393)\r\n==168858==    by 0x434405: pack_file (wavpack.c:1891)\r\n==168858==    by 0x407442: main (wavpack.c:1272)\r\n\r\n```\r\nASAN says:\r\n\r\n```\r\n==169033==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62700001bc9c at pc 0x000000495f60 bp 0x7fff5c6d1640 sp 0x7fff5c6d1630\r\nWRITE of size 2 at 0x62700001bc9c thread T0\r\n    #0 0x495f5f in flush_word /home/thuan/subjects/WavPack-asan/src/write_words.c:502\r\n    #1 0x49169f in send_words_lossless /home/thuan/subjects/WavPack-asan/src/write_words.c:405\r\n    #2 0x45a842 in pack_samples /home/thuan/subjects/WavPack-asan/src/pack.c:1136\r\n    #3 0x4541ba in pack_block /home/thuan/subjects/WavPack-asan/src/pack.c:638\r\n    #4 0x47919f in pack_streams /home/thuan/subjects/WavPack-asan/src/pack_utils.c:951\r\n    #5 0x4772ef in WavpackFlushSamples /home/thuan/subjects/WavPack-asan/src/pack_utils.c:701\r\n    #6 0x40f7f4 in pack_audio /home/thuan/subjects/WavPack-asan/cli/wavpack.c:2393\r\n    #7 0x40d8d8 in pack_file /home/thuan/subjects/WavPack-asan/cli/wavpack.c:1891\r\n    #8 0x40a80b in main /home/thuan/subjects/WavPack-asan/cli/wavpack.c:1272\r\n    #9 0x7f1df62b382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n    #10 0x402528 in _start (/home/thuan/subjects/WavPack-asan/cli/wavpack+0x402528)\r\n\r\n0x62700001bc9d is located 0 bytes to the right of 13213-byte region [0x627000018900,0x62700001bc9d)\r\nallocated by thread T0 here:\r\n    #0 0x7f1df774bf70 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc6f70)\r\n    #1 0x478bb3 in pack_streams /home/thuan/subjects/WavPack-asan/src/pack_utils.c:928\r\n    #2 0x4772ef in WavpackFlushSamples /home/thuan/subjects/WavPack-asan/src/pack_utils.c:701\r\n    #3 0x40f7f4 in pack_audio /home/thuan/subjects/WavPack-asan/cli/wavpack.c:2393\r\n    #4 0x40d8d8 in pack_file /home/thuan/subjects/WavPack-asan/cli/wavpack.c:1891\r\n    #5 0x40a80b in main /home/thuan/subjects/WavPack-asan/cli/wavpack.c:1272\r\n    #6 0x7f1df62b382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/thuan/subjects/WavPack-asan/src/write_words.c:502 in flush_word\r\nShadow bytes around the buggy address:\r\n  0x0c4e7fffb740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c4e7fffb750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c4e7fffb760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c4e7fffb770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c4e7fffb780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x0c4e7fffb790: 00 00 00[05]fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c4e7fffb7a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c4e7fffb7b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c4e7fffb7c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c4e7fffb7d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c4e7fffb7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==169033==ABORTING\r\n```\r\nRegards,\r\n\r\nThuan\r\n[wavpack_crash4.wav.tar.gz](https://github.com/dbry/WavPack/files/1936256/wavpack_crash4.wav.tar.gz)\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/dbry/WavPack/issues/comments/384643717","html_url":"https://github.com/dbry/WavPack/issues/32#issuecomment-384643717","issue_url":"https://api.github.com/repos/dbry/WavPack/issues/32","id":384643717,"user":{"login":"thuanpv","id":3669460,"avatar_url":"https://avatars2.githubusercontent.com/u/3669460?v=4","gravatar_id":"","url":"https://api.github.com/users/thuanpv","html_url":"https://github.com/thuanpv","followers_url":"https://api.github.com/users/thuanpv/followers","following_url":"https://api.github.com/users/thuanpv/following{/other_user}","gists_url":"https://api.github.com/users/thuanpv/gists{/gist_id}","starred_url":"https://api.github.com/users/thuanpv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thuanpv/subscriptions","organizations_url":"https://api.github.com/users/thuanpv/orgs","repos_url":"https://api.github.com/users/thuanpv/repos","events_url":"https://api.github.com/users/thuanpv/events{/privacy}","received_events_url":"https://api.github.com/users/thuanpv/received_events","type":"User","site_admin":false},"created_at":"2018-04-26T13:37:42Z","updated_at":"2018-04-26T13:37:42Z","author_association":"NONE","body":"All 3 issues have been fixed! Thanks."}}
{"actor":{"display_login":"thuanpv"}}