NetBSD Problem Report #49929

From o.vd.linden@quicknet.nl  Mon May 25 18:41:55 2015
Return-Path: <o.vd.linden@quicknet.nl>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id A4806A57FE
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 25 May 2015 18:41:55 +0000 (UTC)
Message-Id: <20150525173534.GA15760@sheep>
Date: Mon, 25 May 2015 19:35:34 +0200
From: Onno van der Linden <o.vd.linden@quicknet.nl>
To: gnats-bugs@netbsd.org
Subject: play from audio/sox can hit sigsegv

>Number:         49929
>Category:       pkg
>Synopsis:       play from audio/sox can hit sigsegv
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bsiegert
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon May 25 18:45:00 +0000 2015
>Closed-Date:    Mon May 25 19:18:42 +0000 2015
>Last-Modified:  Mon May 25 19:18:42 +0000 2015
>Originator:     Onno van der Linden
>Release:        NetBSD 7.99.15
>Organization:
>Environment:
System: NetBSD sheep 7.99.15 NetBSD 7.99.15 (SHEEP) #0: Sat May 9 08:11:50 MEST 2015 onno@sheep:/usr/src/sys/arch/i386/compile/SHEEP i386
Architecture: i386
Machine: i386
>Description:
	play from audio/sox (14.4.2) package can hit a sigsegv
>How-To-Repeat:
$ ls -al x.wav
-rw-r--r--  1 onno  wheel  8240 May 25 15:39 x.wav
$ file x.wav
x.wav: RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz

And with the default buffer size of 8192 and some additional
debug output in sunwrite() (sunaudio.c:444) I get:

$ play -q x.wav                   
cInput=4098 cInputRemaining=4098 cOutput=4096
cInput=4098 cInputRemaining=2 cOutput=4096
cInput=4098 cInputRemaining=4294963202 cOutput=4096
cInput=4098 cInputRemaining=4294959106 cOutput=4096
cInput=4098 cInputRemaining=4294955010 cOutput=4096
[ ... ]
Memory fault (core dumped)


Turns out that osswrite() (oss.c:356) has the same
bug. Fixes below have been sent upstream to the sox-devel
mailinglist.

Onno


>Fix:

--- src/oss.c.orig	2015-05-25 17:12:12.000000000 +0200
+++ src/oss.c	2015-05-25 17:15:28.000000000 +0200
@@ -369,7 +369,7 @@
         size_t cbStride;
         int cbWritten;

-        cStride = cInput;
+        cStride = cInputRemaining;
         if (cStride > pPriv->cOutput) {
             cStride = pPriv->cOutput;
         }
--- src/sunaudio.c.orig	2015-05-25 17:16:43.000000000 +0200
+++ src/sunaudio.c	2015-05-25 17:13:19.000000000 +0200
@@ -442,7 +442,7 @@
         size_t cbStride;
         int cbWritten;

-        cStride = cInput;
+        cStride = cInputRemaining;
         if (cStride > pPriv->cOutput) {
             cStride = pPriv->cOutput;
         }

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: pkg-manager->bsiegert
Responsible-Changed-By: bsiegert@NetBSD.org
Responsible-Changed-When: Mon, 25 May 2015 19:03:11 +0000
Responsible-Changed-Why:
Thanks for the report.


From: "Benny Siegert" <bsiegert@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/49929 CVS commit: pkgsrc/audio/sox
Date: Mon, 25 May 2015 19:06:24 +0000

 Module Name:	pkgsrc
 Committed By:	bsiegert
 Date:		Mon May 25 19:06:24 UTC 2015

 Modified Files:
 	pkgsrc/audio/sox: Makefile distinfo
 Added Files:
 	pkgsrc/audio/sox/patches: patch-src_oss.c patch-src_sunaudio.c

 Log Message:
 Add patches to prevent a segfault when playing certain WAV files. From
 Onno van der Linden in PR pkg/49929. Also submitted upstream.
 Bump PKGREVISION.


 To generate a diff of this commit:
 cvs rdiff -u -r1.61 -r1.62 pkgsrc/audio/sox/Makefile
 cvs rdiff -u -r1.25 -r1.26 pkgsrc/audio/sox/distinfo
 cvs rdiff -u -r0 -r1.1 pkgsrc/audio/sox/patches/patch-src_oss.c \
     pkgsrc/audio/sox/patches/patch-src_sunaudio.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: bsiegert@NetBSD.org
State-Changed-When: Mon, 25 May 2015 19:18:42 +0000
State-Changed-Why:
Patch committed!


>Unformatted:

Home	PR Database Search