{"action":"opened","issue":{"url":"https://api.github.com/repos/taglib/taglib/issues/483","labels_url":"https://api.github.com/repos/taglib/taglib/issues/483/labels{/name}","comments_url":"https://api.github.com/repos/taglib/taglib/issues/483/comments","events_url":"https://api.github.com/repos/taglib/taglib/issues/483/events","html_url":"https://github.com/taglib/taglib/issues/483","id":53217175,"number":483,"title":"Segfault with fuzzed file (oggflac)","user":{"login":"tholin","id":5354985,"avatar_url":"https://avatars.githubusercontent.com/u/5354985?v=3","gravatar_id":"","url":"https://api.github.com/users/tholin","html_url":"https://github.com/tholin","followers_url":"https://api.github.com/users/tholin/followers","following_url":"https://api.github.com/users/tholin/following{/other_user}","gists_url":"https://api.github.com/users/tholin/gists{/gist_id}","starred_url":"https://api.github.com/users/tholin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tholin/subscriptions","organizations_url":"https://api.github.com/users/tholin/orgs","repos_url":"https://api.github.com/users/tholin/repos","events_url":"https://api.github.com/users/tholin/events{/privacy}","received_events_url":"https://api.github.com/users/tholin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-01T10:31:21Z","updated_at":"2015-01-01T10:31:21Z","closed_at":null,"body":"Parsing the following file with the tagreader example results in a segfault.\r\nhttps://www.dropbox.com/s/1gjqpn6ljlno2p0/taglib_oggflac_segfault.oga\r\n\r\n```\r\n$ gdb --args ~/repository/taglib/build/examples/tagreader taglib_oggflac_segfault.oga \r\nGNU gdb (Gentoo 7.7.1 p1) 7.7.1\r\nCopyright (C) 2014 Free Software Foundation, Inc.\r\nLicense GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>\r\nThis is free software: you are free to change and redistribute it.\r\nThere is NO WARRANTY, to the extent permitted by law.  Type \"show copying\"\r\nand \"show warranty\" for details.\r\nThis GDB was configured as \"x86_64-pc-linux-gnu\".\r\nType \"show configuration\" for configuration details.\r\nFor bug reporting instructions, please see:\r\n<http://bugs.gentoo.org/>.\r\nFind the GDB manual and other documentation resources online at:\r\n<http://www.gnu.org/software/gdb/documentation/>.\r\nFor help, type \"help\".\r\nType \"apropos word\" to search for commands related to \"word\"...\r\nReading symbols from /home/cocobo/repository/taglib/build/examples/tagreader...done.\r\n(gdb) r\r\nStarting program: /home/cocobo/repository/taglib/build/examples/tagreader taglib_oggflac_segfault.oga\r\nwarning: Could not load shared library symbols for linux-vdso.so.1.\r\nDo you need \"set solib-search-path\" or \"set sysroot\"?\r\n******************** \"taglib_oggflac_segfault.oga\" ********************\r\n\r\nProgram received signal SIGSEGV, Segmentation fault.\r\n0x00007ffff7a0c9bc in TagLib::Ogg::FLAC::File::scan (this=0x617cd0)\r\n    at /home/cocobo/repository/taglib/taglib/ogg/flac/oggflacfile.cpp:247\r\n247       char blockType = header[0] & 0x7f;\r\n(gdb) bt full\r\n#0  0x00007ffff7a0c9bc in TagLib::Ogg::FLAC::File::scan (this=0x617cd0)\r\n    at /home/cocobo/repository/taglib/taglib/ogg/flac/oggflacfile.cpp:247\r\n        ipacket = 1\r\n        overhead = 0\r\n        metadataHeader = {_vptr.ByteVector = 0x7ffff7dce5f0 <vtable for TagLib::ByteVector+16>, \r\n          static null = {_vptr.ByteVector = 0x7ffff7dce5f0 <vtable for TagLib::ByteVector+16>, \r\n            static null = <same as static member of an already seen type>, d = 0x616b40}, \r\n          d = 0x6184a0}\r\n        blockType = 90 'Z'\r\n        lastBlock = 255\r\n        length = 0\r\n        header = {_vptr.ByteVector = 0x7ffff7dce5f0 <vtable for TagLib::ByteVector+16>, \r\n          static null = {_vptr.ByteVector = 0x7ffff7dce5f0 <vtable for TagLib::ByteVector+16>, \r\n            static null = <same as static member of an already seen type>, d = 0x616b40}, \r\n          d = 0x6194c0}\r\n#1  0x00007ffff7a0baf4 in TagLib::Ogg::FLAC::File::read (this=0x617cd0, readProperties=true, \r\n    propertiesStyle=TagLib::AudioProperties::Average)\r\n    at /home/cocobo/repository/taglib/taglib/ogg/flac/oggflacfile.cpp:164\r\nNo locals.\r\n#2  0x00007ffff7a0aa45 in TagLib::Ogg::FLAC::File::File (this=0x617cd0, \r\n    file=0x7fffffffde7e \"taglib_oggflac_segfault.oga\", readProperties=true, \r\n    propertiesStyle=TagLib::AudioProperties::Average)\r\n    at /home/cocobo/repository/taglib/taglib/ogg/flac/oggflacfile.cpp:77\r\nNo locals.\r\n#3  0x00007ffff7b7aa8c in TagLib::FileRef::create (\r\n    fileName=0x7fffffffde7e \"taglib_oggflac_segfault.oga\", readAudioProperties=true, \r\n    audioPropertiesStyle=TagLib::AudioProperties::Average)\r\n    at /home/cocobo/repository/taglib/taglib/fileref.cpp:246\r\n        file = 0x0\r\n        it = \r\n        ext = {_vptr.String = 0x7ffff7dce4f0 <vtable for TagLib::String+16>, static null = {\r\n            _vptr.String = 0x7ffff7dce4f0 <vtable for TagLib::String+16>, \r\n            static null = <same as static member of an already seen type>, \r\n            static WCharByteOrder = TagLib::String::UTF16LE, d = 0x616af0}, \r\n          static WCharByteOrder = TagLib::String::UTF16LE, d = 0x617db0}\r\n#4  0x00007ffff7b77ad1 in TagLib::FileRef::FileRef (this=0x7fffffffd8d0, \r\n    fileName=0x7fffffffde7e \"taglib_oggflac_segfault.oga\", readAudioProperties=true, \r\n    audioPropertiesStyle=TagLib::AudioProperties::Average)\r\n    at /home/cocobo/repository/taglib/taglib/fileref.cpp:83\r\nNo locals.\r\n#5  0x00000000004048a7 in main (argc=2, argv=0x7fffffffda58)\r\n    at /home/cocobo/repository/taglib/examples/tagreader.cpp:41\r\n        f = {_vptr.FileRef = 0x7ffff7dd0610 <vtable for TagLib::FileRef+16>, d = 0x404792 <main+34>}\r\n        i = 1\r\n#6  0x00007ffff6c76dc5 in __libc_start_main () from /lib64/libc.so.6\r\nNo symbol table info available.\r\n#7  0x00000000004046a9 in _start ()\r\nNo symbol table info available.\r\n(gdb) list\r\n242       //    ..\r\n243       //    4 : VORBIS_COMMENT\r\n244       //    ..\r\n245       // <24> Length of metadata to follow\r\n246\r\n247       char blockType = header[0] & 0x7f;\r\n248       bool lastBlock = (header[0] & 0x80) != 0;\r\n249       uint length = header.toUInt(1, 3, true);\r\n250       overhead += length;\r\n251\r\n(gdb) print header.size()\r\n$1 = 0\r\n```"}}