Bug#772088: gettext: msgunfmt segfaults (system-dependent messages)

[Jakub Wilk]

Package: gettext
Version: 0.19.3-2

The attached MO files (crash-*.mo) make msgunfmt segfault.




[0] http://lcamtuf.coredump.cx/afl/


-- System Information:
Debian Release: 8.0
 APT prefers unstable
 APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages gettext depends on:
ii  dpkg           1.17.22
ii  gettext-base   0.19.3-2
ii  install-info   5.2.0.dfsg.1-5
ii  libc6          2.19-13
ii  libcroco3      0.6.8-3+b1
ii  libglib2.0-0   2.42.1-1
ii  libgomp1       4.9.2-5
ii  libncurses5    5.9+20140913-1
ii  libtinfo5      5.9+20140913-1
ii  libunistring0  0.9.3-5.2
ii  libxml2        2.9.2+dfsg1-1

Versions of packages gettext recommends:
ii  autopoint         0.19.3-2
ii  curl              7.38.0-3
ii  libasprintf-dev   0.19.3-2
ii  libgettextpo-dev  0.19.3-2
ii  wget              1.16-3

--
Jakub Wilk

This bug was found using American fuzzy lop[0], which was seeded with a MO file containing system-dependent messages (original.mo).

crash-0.mo
Description: Binary data

crash-1.mo
Description: Binary data

crash-2.mo
Description: Binary data

crash-3.mo
Description: Binary data

crash-4.mo
Description: Binary data

original.mo
Description: Binary data