Debian Bug report logs - #782831
libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Tobias Frost <tobi@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Sat, 18 Apr 2015 14:31:00 +0200

Package: libvorbis-dev
Version: 1.3.4-2
Severity: normal

Dear Maintainer,

Please read for a background:  https://github.com/dhewm/dhewm3/issues/104

Short: dhewm3 calls ov_pcm_seek_page(), where an object of ogg_page (og) is created
on the heap, which seems should be initialized by the call to _get_next_page().
However the call to this function is not successful, returnin OV_EOF (-2) and
the result is that ogg_page is not initialized but still later used, even if the code
recognized that bisection fails (bisec==-1). However, it still accesses it in
the call to  ogg_page_serialno(&og) leading to a SEGV.

A special guard for this, first initializing og.header with NULL and checking for it later
makes the SIGSE'm unsure if this fix is "sane". With that disclaimer, here's the patch I used:

diff -Naur libvorbis-1.3.4/lib/vorbisfile.c libvorbis-1.3.4_/lib/vorbisfile.c  
--- libvorbis-1.3.4/lib/vorbisfile.c    2015-04-18 14:28:43.000000000 +0200
+++ libvorbis-1.3.4_/lib/vorbisfile.c   2015-04-18 14:04:34.262733024 +0200
@@ -1442,6 +1442,7 @@
     ogg_int64_t best=-1;
 
     ogg_page og;
+    og.header = 0;
     /* bisection loop */
     while(begin<end){
       ogg_int64_t bisect;
@@ -1550,6 +1551,11 @@
          bisection would 'fail' because our search target was before the
          first PCM granule position fencepost. */
 
+      if (!og.header) {
+         result = -1;
+         goto seek_error;
+      }
+
       if(begin == vf->dataoffsets[link] &&
          ogg_page_serialno(&og)==vf->serialnos[link]){
 


Please let me know how I can help...

--
tobi


-- System Information:
Debian Release: 8.0
  APT prefers testing-updates
  APT policy: (500, 'testing-updates'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libvorbis-dev depends on:
ii  libogg-dev      1.3.2-1
ii  libvorbis0a     1.3.4-2
ii  libvorbisenc2   1.3.4-2
ii  libvorbisfile3  1.3.4-2

libvorbis-dev recommends no packages.

libvorbis-dev suggests no packages.

-- no debconf information

Message #10 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Martin Steghöfer <martin@steghoefer.eu>

To: 782831@bugs.debian.org

Cc: Tobias Frost <tobi@debian.org>

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Mon, 20 Apr 2015 06:43:51 +0200

[Message part 1 (text/plain, inline)]

Dear Tobi,

Thank you for the bug report and your analysis of the problem.

The error handling is one thing. A library should be robust to failures 
and not crash the whole product. The crashing doesn't happen on other 
distros because for bug #762571 we backported an upstream change that 
fixes an infinite loop when seeking to 0 and that new code is apparently 
less robust to internal failures. Since the code comes from upstream, 
their current SVN head has probably the same problem.

But on the other hand I don't think there is a reason for the internal 
function _get_next_page to fail. I think the function ov_pcm_seek_page 
is allowed to assume that under the given circumstances the call to 
_get_next_page has to succeed. So mitigating the problem by making the 
code more robust (as your patch does) would avoid the crash, but the 
call to ov_pcm_seek_page would still fail without justification and the 
playback would have to be aborted.

That's why I tried to find the underlying problem. Unfortunately, the 
fact that the only known way to trigger the bug was via "dhewm3" 
required me to build that application and even dig out a copy of Doom 3, 
which is apparently required to run the test case. Finally I was able to 
extract the data that triggered the crash and reproduce the crash in a 
simple executable without "dhewm3". Further debugging revealed that the 
problem can be triggered by doing two subsequent seeks to 0 on any very 
short vorbis file (not only the one extracted from "dhewm3" / Doom 3) - 
which is great because this way we have an example file that can be 
posted here without copyright trouble.

For now that's as far as I got. But at least the bug is isolated now 
(see attached files; compile vorbistest.c against libvorbis-dev and 
execute it with the path to silence-short.ogg as first parameter). When 
I have more time, I can do further debugging to find the root of the 
problem.

Cheers,
Martin




El 18-04-2015 a les 14:31, Tobias Frost ha escrit:
> Package: libvorbis-dev
> Version: 1.3.4-2
> Severity: normal
>
> Dear Maintainer,
>
> Please read for a background:  https://github.com/dhewm/dhewm3/issues/104
>
> Short: dhewm3 calls ov_pcm_seek_page(), where an object of ogg_page (og) is created
> on the heap, which seems should be initialized by the call to _get_next_page().
> However the call to this function is not successful, returnin OV_EOF (-2) and
> the result is that ogg_page is not initialized but still later used, even if the code
> recognized that bisection fails (bisec==-1). However, it still accesses it in
> the call to  ogg_page_serialno(&og) leading to a SEGV.
>
> A special guard for this, first initializing og.header with NULL and checking for it later
> makes the SIGSE'm unsure if this fix is "sane". With that disclaimer, here's the patch I used:
>
> diff -Naur libvorbis-1.3.4/lib/vorbisfile.c libvorbis-1.3.4_/lib/vorbisfile.c
> --- libvorbis-1.3.4/lib/vorbisfile.c    2015-04-18 14:28:43.000000000 +0200
> +++ libvorbis-1.3.4_/lib/vorbisfile.c   2015-04-18 14:04:34.262733024 +0200
> @@ -1442,6 +1442,7 @@
>       ogg_int64_t best=-1;
>   
>       ogg_page og;
> +    og.header = 0;
>       /* bisection loop */
>       while(begin<end){
>         ogg_int64_t bisect;
> @@ -1550,6 +1551,11 @@
>            bisection would 'fail' because our search target was before the
>            first PCM granule position fencepost. */
>   
> +      if (!og.header) {
> +         result = -1;
> +         goto seek_error;
> +      }
> +
>         if(begin == vf->dataoffsets[link] &&
>            ogg_page_serialno(&og)==vf->serialnos[link]){
>   
>
>
> Please let me know how I can help...
>
> --
> tobi
>
>
> -- System Information:
> Debian Release: 8.0
>    APT prefers testing-updates
>    APT policy: (500, 'testing-updates'), (500, 'testing')
> Architecture: amd64 (x86_64)
> Foreign Architectures: i386
>
> Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
> Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
> Init: systemd (via /run/systemd/system)
>
> Versions of packages libvorbis-dev depends on:
> ii  libogg-dev      1.3.2-1
> ii  libvorbis0a     1.3.4-2
> ii  libvorbisenc2   1.3.4-2
> ii  libvorbisfile3  1.3.4-2
>
> libvorbis-dev recommends no packages.
>
> libvorbis-dev suggests no packages.
>
> -- no debconf information
>

[vorbistest.c (text/x-csrc, attachment)]

[silence-short.ogg (video/ogg, attachment)]

Message #15 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Martin Steghöfer <martin@steghoefer.eu>

To: 782831@bugs.debian.org

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Mon, 20 Apr 2015 22:22:44 +0200

Update: This is related to the beginning-of-stream special case for 
seeking and to the fact that there is only one "normal" ogg page in the 
file. The first time this special case is used, it seems to advance the 
page pointer to a place where the same special case cannot find any page 
during the second seek because the stream ends (that type of seeking 
works only forward).

Message #20 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@gambaru.de>

To: 782831@bugs.debian.org

Cc: Martin Steghöfer <martin@steghoefer.eu>, Tobias Frost <tobi@debian.org>

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Thu, 11 Jun 2015 12:35:51 +0200

[Message part 1 (text/plain, inline)]

On Mon, 20 Apr 2015 22:22:44 +0200 =?windows-1252?Q?Martin_Stegh=F6fer?=
<martin@steghoefer.eu> wrote:
> Update: This is related to the beginning-of-stream special case for 
> seeking and to the fact that there is only one "normal" ogg page in the 
> file. The first time this special case is used, it seems to advance the 
> page pointer to a place where the same special case cannot find any page 
> during the second seek because the stream ends (that type of seeking 
> works only forward).

Hi,

You might be interested to know that the developers of Wesnoth believe
that this bug is the root cause for another segmentation fault in their
game.

https://bugs.debian.org/780853

Regards,

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #25 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Tobias Frost <tobi@debian.org>

To: 782831@bugs.debian.org

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Fri, 12 Jun 2015 15:06:13 +0200

Hi Martin,

Did you report this issue already upstream? Could not find it on their
BTS...


-- 
tobi

Message #30 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Tobias Frost <tobi@frost.de>

To: 782831@bugs.debian.org, apo@gambaru.de

Subject: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3 -- fixed in new upstream version

Date: Fri, 12 Jun 2015 17:18:22 +0200

[Message part 1 (text/plain, inline)]

Control: tags -1 fixed-upstream

Update: 
I pulled the new upstream version 1.3.5 and locally built a package.
With that package, dhwem3 does not crash anymore.

(Attached for your convenience the diff of the debian directory;
however, it's quick and dirty and not fit for an upload; especially mind
that there are symbols changing!)

Markus: Do you want to give it a try for wesnoth too?

--
tobi

[libvorbis-1.3.5.patch (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #37 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Martin Steghöfer <martin@steghoefer.eu>

To: Tobias Frost <tobi@frost.de>

Cc: 782831@bugs.debian.org, apo@gambaru.de

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3 -- fixed in new upstream version

Date: Sun, 14 Jun 2015 13:34:31 +0200

Hi Tobias!

Thank you for the effort! I've already identified the problem. The 
upstream commit we imported in order to fix #762571 had some issues that 
were fixed later in the upstream repository (but never imported into the 
Debian package). I've identified the relevant commits and they seem to 
fix the problem in the Debian package, but I haven't gotten around to 
doing an exhaustive testing.

Those fixes are, of course, contained in 1.3.5, but since packaging 
1.3.5 may require a little more time, I may upload the patches for 1.3.4 
anyway.

Cheers,
Martin

Message #42 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Martin Steghöfer <martin@steghoefer.eu>

To: Tobias Frost <tobi@debian.org>

Cc: 782831@bugs.debian.org

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Sun, 14 Jun 2015 13:37:29 +0200

El 12-06-2015 a les 15:06, Tobias Frost ha escrit:
> Did you report this issue already upstream? Could not find it on their
> BTS...

Not necessary because upstream doesn't have the problem.

Martin

Message #49 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@gambaru.de>

To: Martin Steghöfer <martin@steghoefer.eu>, Tobias Frost <tobi@frost.de>

Cc: 782831@bugs.debian.org, 780853@bugs.debian.org, shadowm2006@gmail.com

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3 -- fixed in new upstream version

Date: Sun, 14 Jun 2015 14:08:48 +0200

[Message part 1 (text/plain, inline)]

Control: reassign 780853 libvorbis-dev
Control: forcemerge 782831 780853

On 14.06.2015 13:34, Martin Steghöfer wrote:
> Hi Tobias!
> 
> Thank you for the effort! I've already identified the problem. The
> upstream commit we imported in order to fix #762571 had some issues that
> were fixed later in the upstream repository (but never imported into the
> Debian package). I've identified the relevant commits and they seem to
> fix the problem in the Debian package, but I haven't gotten around to
> doing an exhaustive testing.
> 
> Those fixes are, of course, contained in 1.3.5, but since packaging
> 1.3.5 may require a little more time, I may upload the patches for 1.3.4
> anyway.


I have tested the new upstream release of libvorbis, 1.3.5, and I can
confirm that this also solves the Wesnoth crashes thus I am going to
reassign #780853 to libvorbis-dev. Thanks to Ignacio for finding the
cause and solution for this issue.

Regards,

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #58 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Tobias Frost <tobi@debian.org>

To: 782831@bugs.debian.org

Subject: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Tue, 11 Aug 2015 19:59:27 +0200

Hi Martin

Any progress on packaging the new upstream version or backporting the
changes?

Thanks!

--
tobi

Message #65 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Tobias Frost <tobi@debian.org>

To: 782831@bugs.debian.org

Subject: Re: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Sun, 13 Sep 2015 21:44:54 +0200

Control: severity -1 important

Bumping severity as dhewm3 is now in sid: This makes the game quite
unplayable.

I'm currently considering to NMU the workaround.

--
tobi

Message #72 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Martin Steghöfer <martin@steghoefer.eu>

To: 782831@bugs.debian.org

Cc: Tobias Frost <tobi@debian.org>

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Tue, 15 Sep 2015 23:40:01 +0200

Tobias Frost wrote:
> I'm currently considering to NMU the workaround.

I hope that I get around to integrating the 1.3.4 patch or packaging 
1.3.5 this weekend. Otherwise, please NMU the workaround. It may not be 
too nice to just have a workaround, but I consider it safe.

Best,
Martin

Message #77 received at 782831@bugs.debian.org (full text, mbox, reply):

From: Martin Steghöfer <martin@steghoefer.de>

To: control@bugs.debian.org, 782831@bugs.debian.org

Cc: Tobias Frost <tobi@debian.org>, Petter Reinholdtsen <pere@hungry.com>

Subject: Re: Bug#782831: libvorbis: use of non-initialized variable leads to SIGSEV in dhewm3

Date: Mon, 21 Sep 2015 01:22:56 +0200

[Message part 1 (text/plain, inline)]

tags 782831 + pending
thanks

Backported upstream patches for the issue and tested for the issue at 
hand and for possible regression. Uploaded to git repository.

Cheers,
Martin

[smime.p7s (application/pkcs7-signature, attachment)]

Message #84 received at 782831-close@bugs.debian.org (full text, mbox, reply):

From: Petter Reinholdtsen <pere@debian.org>

To: 782831-close@bugs.debian.org

Subject: Bug#782831: fixed in libvorbis 1.3.4-3

Date: Tue, 22 Sep 2015 12:49:48 +0000

Source: libvorbis
Source-Version: 1.3.4-3

We believe that the bug you reported is fixed in the latest version of
libvorbis, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 782831@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Petter Reinholdtsen <pere@debian.org> (supplier of updated libvorbis package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 22 Sep 2015 14:30:24 +0200
Source: libvorbis
Binary: libvorbis0a libvorbisenc2 libvorbisfile3 libvorbis-dev libvorbis-dbg
Architecture: source
Version: 1.3.4-3
Distribution: unstable
Urgency: low
Maintainer: Debian Xiph.org Maintainers <pkg-xiph-maint@lists.alioth.debian.org>
Changed-By: Petter Reinholdtsen <pere@debian.org>
Description:
 libvorbis-dbg - debug files for Vorbis General Audio Compression Codec
 libvorbis-dev - development files for Vorbis General Audio Compression Codec
 libvorbis0a - decoder library for Vorbis General Audio Compression Codec
 libvorbisenc2 - encoder library for Vorbis General Audio Compression Codec
 libvorbisfile3 - high-level API for Vorbis General Audio Compression Codec
Closes: 774516 782831
Changes:
 libvorbis (1.3.4-3) unstable; urgency=low
 .
   [ Martin Steghöfer ]
   * Fix crash on corrupt input file (invalid mode index). (Closes: #774516)
   * Take into account error codes returned from
     "vorbis_packet_blocksize" in "_initial_pcmoffset" (follow-up
     problem related to #774516).  Thanks to Timothy B. Terriberry
   * Fix segmentation fault on two subsequent seeks to 0. (Closes: #782831)
 .
   [ Petter Reinholdtsen ]
   * Add debian/gbp.conf to enforce the user of pristine-tar.
Checksums-Sha1:
 93e59c70a89c685d48e75f4fc6376df635789d53 2395 libvorbis_1.3.4-3.dsc
 058c505b71d17ef8af3fb13cef91b82db772397f 14640 libvorbis_1.3.4-3.debian.tar.xz
Checksums-Sha256:
 34a977cf3ff7ad95171d08d2a057ad07d7b1a048c6ff6030cb6da82009e9be99 2395 libvorbis_1.3.4-3.dsc
 5f6e1cd62f001fa9a3f5ed1e9fb601e32d8addf244e3f01d27ab85b13e74509e 14640 libvorbis_1.3.4-3.debian.tar.xz
Files:
 5faba14886b486b01d283aed47a16381 2395 libs optional libvorbis_1.3.4-3.dsc
 d6664163c34443784b26f3c11f1084be 14640 libs optional libvorbis_1.3.4-3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Comment: Debian powered!

iQJ8BAEBCgBmBQJWAUzfXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRGM0REMDlGOERBODdEMURGNTA0NkM5OUIw
NjEyRjQ5NDRFQ0RDRDVBAAoJEAYS9JROzc1a5qwQALYft9m8omYS4cbkLMwGZcL3
dZrVni1XeSh8ZXMenzyiYptyVUu5zfolgV8IH4yZ1Xm1Hseu6T8OUEOk7ps920+t
p42PRZglgJ+njLQgkomQ4h05w0NrzyenESpQ/WeuE0C7ByFRxwqJsWKDRInsR0cZ
f9eFbrfMcLZpKeNJpEHlX60NsrmLkXTPhrv3/uSzLVCHWXWRq8ErfnFg0co7bYwO
p9qQ9wRd4NZ96Yg0oA7C/DylbsrBln/NXjwDaWKe5LTOCFE1rA9vVN/CvNLziyyr
h/03sRUXs7rQM2NS7eErpnOF9VJbEOQ7qihh7cBSYx3dZ8ZorextoYag+jIR0Bm7
iC0Zjd5eaBqYcT0wutnIZA9OLtBFLplCGWVEWR+zoqZcm14hDALx3LupQc1JQXDh
UblmWy84dD/EYheIbxem96jotxSqtxC6oueZsrwsIJwnaYO6Gon0PFFPnqlTY025
11xlK+wM0G4y0+RZKbc0t5ehEA48kRUr9OzmijTqEi+9/WsNIq293QIeRLmL8zT8
zCdZigK/1HmwBjwws+pY2q1sQbwkQL5HRxJfWy3UIsa1+vF9jvjoNcpk74BW6Azh
dc4IpIYBJb4HWjw0MAwXSxeqWT9b87X4aTA4uegtUAJsiixpYKXU2jAUxcInOjXN
+JBNhhLb4STEl+n/xarK
=NFhp
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.