Re: Multiple bugs/vulns(?)

On 08/11/14 02:19, Robert Hegemann wrote:
>
> You can get sources for lame version 3.100 here:
>
> http://lame.cvs.sourceforge.net/viewvc/lame/lame/?view=tar
>
Both bugs still present.

But, different file lines in the files(of course):

Per bug 1:

> Program received signal SIGFPE, Arithmetic exception.
> 0x0000000000406e74 in parse_wave_header (gfp=0x69c230, sf=0x6b5960) at
> get_audio.c:1468
> 1468                (void) lame_set_num_samples(gfp, data_length /
> (channels * ((bits_per_sample + 7) / 8)));
> (gdb) bt
> #0  0x0000000000406e74 in parse_wave_header (gfp=0x69c230,
> sf=0x6b5960) at get_audio.c:1468
> #1  0x00000000004074f7 in parse_file_header (gfp=0x69c230,
> sf=0x6b5960) at get_audio.c:1697
> #2  0x0000000000407875 in open_wave_file (gfp=0x69c230,
> inPath=0x7fffffffafe0 "lame_bug1.wav", enc_delay=0x7ffffff32828,
> enc_padding=0x7ffffff3282c) at get_audio.c:1809
> #3  0x0000000000405a8d in init_infile (gfp=0x69c230,
> inPath=0x7fffffffafe0 "lame_bug1.wav") at get_audio.c:622
> #4  0x0000000000401d91 in init_files (gf=0x69c230,
> inPath=0x7fffffffafe0 "lame_bug1.wav", outPath=0x7fffffffbff0
> "lol.mp3") at lame_main.c:116
> #5  0x00000000004033aa in lame_main (gf=0x69c230, argc=3,
> argv=0x7fffffffe148) at lame_main.c:636
> #6  0x00000000004036d0 in c_main (argc=3, argv=0x7fffffffe148) at
> main.c:470
> #7  0x000000000040367d in main (argc=3, argv=0x7fffffffe148) at main.c:438


Per bug 2:
> Program received signal SIGSEGV, Segmentation fault.
> 0x0000000000431782 in fill_buffer_resample (gfc=0x69f3c0,
> outbuf=0x6ad210, desired_len=576, inbuf=0x6b9fd0, len=576,
> num_used=0x7ffffff0c2b8, ch=0) at util.c:607
> 607                 y = (j2 < 0) ? inbuf_old[BLACKSIZE + j2] : inbuf[j2];
> (gdb) bt
> #0  0x0000000000431782 in fill_buffer_resample (gfc=0x69f3c0,
> outbuf=0x6ad210, desired_len=576, inbuf=0x6b9fd0, len=576,
> num_used=0x7ffffff0c2b8, ch=0) at util.c:607
> #1  0x0000000000431a99 in fill_buffer (gfc=0x69f3c0,
> mfbuf=0x7ffffff0c270, in_buffer=0x7ffffff0c290, nsamples=576,
> n_in=0x7ffffff0c2b8, n_out=0x7ffffff0c2bc) at util.c:677
> #2  0x000000000041d6f9 in lame_encode_buffer_sample_t (gfc=0x69f3c0,
> nsamples=576, mp3buf=0x7ffffff0e8e8 "", mp3buf_size=147456) at lame.c:1707
> #3  0x000000000041e044 in lame_encode_buffer_template (gfp=0x69c230,
> buffer_l=0x7ffffff0c3d0, buffer_r=0x7ffffff0d5d0, nsamples=576,
> mp3buf=0x7ffffff0e810 "\377\343\070D", mp3buf_size=147456,
> pcm_type=pcm_int_type, aa=1,
>     norm=1.52587891e-05) at lame.c:1862
> #4  0x000000000041e2e5 in lame_encode_buffer_int (gfp=0x69c230,
> pcm_l=0x7ffffff0c3d0, pcm_r=0x7ffffff0d5d0, nsamples=576,
> mp3buf=0x7ffffff0e810 "\377\343\070D", mp3buf_size=147456) at lame.c:1934
> #5  0x0000000000402a36 in lame_encoder_loop (gf=0x69c230,
> outf=0x6b5ba0, nogap=0, inPath=0x7fffffffafe0 "lame_bug2.wav",
> outPath=0x7fffffffbff0 "lol.mp3") at lame_main.c:429
> #6  0x0000000000402cf9 in lame_encoder (gf=0x69c230, outf=0x6b5ba0,
> nogap=0, inPath=0x7fffffffafe0 "lame_bug2.wav", outPath=0x7fffffffbff0
> "lol.mp3") at lame_main.c:498
> #7  0x00000000004034b8 in lame_main (gf=0x69c230, argc=3,
> argv=0x7fffffffe148) at lame_main.c:669
> #8  0x00000000004036d0 in c_main (argc=3, argv=0x7fffffffe148) at
> main.c:470
> #9  0x000000000040367d in main (argc=3, argv=0x7fffffffe148) at main.c:438



Hope that helps.

Thanks,

-- 
-- Joshua Rogers <https://internot.info/>

------------------------------------------------------------------------------

_______________________________________________
Lame-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/lame-dev