{"action":"opened","issue":{"url":"https://api.github.com/repos/dbry/WavPack/issues/9","labels_url":"https://api.github.com/repos/dbry/WavPack/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/dbry/WavPack/issues/9/comments","events_url":"https://api.github.com/repos/dbry/WavPack/issues/9/events","html_url":"https://github.com/dbry/WavPack/issues/9","id":122595354,"number":9,"title":"unpack_samples crash on unicode branch","user":{"login":"mark4o","id":821151,"avatar_url":"https://avatars.githubusercontent.com/u/821151?v=3","gravatar_id":"","url":"https://api.github.com/users/mark4o","html_url":"https://github.com/mark4o","followers_url":"https://api.github.com/users/mark4o/followers","following_url":"https://api.github.com/users/mark4o/following{/other_user}","gists_url":"https://api.github.com/users/mark4o/gists{/gist_id}","starred_url":"https://api.github.com/users/mark4o/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mark4o/subscriptions","organizations_url":"https://api.github.com/users/mark4o/orgs","repos_url":"https://api.github.com/users/mark4o/repos","events_url":"https://api.github.com/users/mark4o/events{/privacy}","received_events_url":"https://api.github.com/users/mark4o/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-16T20:34:00Z","updated_at":"2015-12-16T20:34:00Z","closed_at":null,"body":"With the fix for #8 there is a new crash in unpack_samples on some invalid files:\r\n\r\n    Invalid write of size 4\r\n       at 0x10004593C: unpack_samples (unpack.c:111)\r\n       by 0x10004BEEC: WavpackUnpackSamples (unpack_utils.c:246)\r\n       by 0x10000363A: unpack_file (wvunpack.c:1652)\r\n       by 0x1000023DE: main (wvunpack.c:523)\r\n     Address 0x100a670e0 is 0 bytes after a block of size 21,392 alloc'd\r\n       at 0x100015EBB: malloc (vg_replace_malloc.c:303)\r\n       by 0x10004BBF0: WavpackUnpackSamples (unpack_utils.c:172)\r\n       by 0x10000363A: unpack_file (wvunpack.c:1652)\r\n       by 0x1000023DE: main (wvunpack.c:523)\r\n    \r\n    Invalid read of size 2\r\n       at 0x1000375F7: get_word (read_words.c:123)\r\n       by 0x100045926: unpack_samples (unpack.c:111)\r\n       by 0x10004BEEC: WavpackUnpackSamples (unpack_utils.c:246)\r\n       by 0x10000363A: unpack_file (wvunpack.c:1652)\r\n       by 0x1000023DE: main (wvunpack.c:523)\r\n     Address 0x10179dcc07ffffff is not stack'd, malloc'd or (recently) free'd\r\n\r\nThe crash can be reproduced on the unicode branch (b258e05) with the command `wvunpack in.wv -o out.wav` using the following test case (1496 bytes, base64-encoded):\r\n\r\nd3Zwa+QCAAAQBDAwMDAwMDDqAAAwMAAABQ8wBTAwMDACAVdWMAEwMDACMDAwMA0DMDAAMDAwijABADAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMHd2cGvkAgAAEAQwMDAwMAAwnwAAMIAAAD4wMDAwMDAwAgFXVjABMAAwAjAwMDAFAzD6MAcwMIowAQAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA=\r\n\r\nAlso the unpacking may now produce uninitialized data.  For example, uninitialized data is written to stdout when unpacking the test case from #8 with `wvunpack in.wv -o -`:\r\n\r\n    Syscall param write(buf) points to uninitialised byte(s)\r\n       at 0x10042E97A: write$NOCANCEL (in /usr/lib/system/libsystem_kernel.dylib)\r\n       by 0x100328844: _swrite (in /usr/lib/system/libsystem_c.dylib)\r\n       by 0x1003212FE: __sflush (in /usr/lib/system/libsystem_c.dylib)\r\n       by 0x100323BC7: __sfvwrite (in /usr/lib/system/libsystem_c.dylib)\r\n       by 0x100323F02: fwrite (in /usr/lib/system/libsystem_c.dylib)\r\n       by 0x100007F19: DoWriteFile (utils.c:637)\r\n       by 0x100003707: unpack_file (wvunpack.c:1021)\r\n       by 0x1000023DE: main (wvunpack.c:523)\r\n     Address 0x10099c6ba is 74 bytes inside a block of size 4,096 alloc'd\r\n       at 0x100015EBB: malloc (vg_replace_malloc.c:303)\r\n       by 0x10032468E: __smakebuf (in /usr/lib/system/libsystem_c.dylib)\r\n       by 0x1003391DF: __swsetup (in /usr/lib/system/libsystem_c.dylib)\r\n       by 0x100323928: __sfvwrite (in /usr/lib/system/libsystem_c.dylib)\r\n       by 0x100323F02: fwrite (in /usr/lib/system/libsystem_c.dylib)\r\n       by 0x100007F19: DoWriteFile (utils.c:637)\r\n       by 0x100006EC2: write_riff_header (wvunpack.c:1616)\r\n       by 0x10000351A: unpack_file (wvunpack.c:1907)\r\n       by 0x1000023DE: main (wvunpack.c:523)\r\n     Uninitialised value was created by a heap allocation\r\n       at 0x100015EBB: malloc (vg_replace_malloc.c:303)\r\n       by 0x100003574: unpack_file (wvunpack.c:1908)\r\n       by 0x1000023DE: main (wvunpack.c:523)\r\n\r\nWhen repacking, the uninitialized data is consumed and processed by the packing code."}}