Package: cabextract
Version: 1.4-4+b1
Usertags: afl
cabextract crashes (trying to dereference null pointed) on the attached
crafted CAB file:
$ gpg -d nullderef.cab.asc > nullderef.cab
$ cabextract -t nullderef.cab
nullderef.cab: WARNING; possible 1626 extra bytes at end of file.
Testing cabinet: nullderef.cab
failed (error in CAB data format)
failed (Success)
E failed (error in CAB data format)
Segmentation fault
Backtrace:
#0 0x00000000 in ?? ()
#1 0x0804e094 in cabd_extract (base=0x805b008, file=0x8063600, filename=0x8056643
"test") at mspack/cabd.c:1068
#2 0x080493b4 in process_cabinet (basename=0xffffd9b8 "nullderef.cab") at
src/cabextract.c:467
#3 0x08048fc4 in main (argc=3, argv=0xffffd804) at src/cabextract.c:350
This bug was found using American fuzzy lop:
https://packages.debian.org/experimental/afl
-- System Information:
Debian Release: 8.0
APT prefers unstable
APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64
Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages cabextract depends on:
ii libc6 2.19-13
--
Jakub Wilk
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
owFby+6ZxJtXmpOTklqUmqaXnJgUMp1J0TfY2Y0BCO4wQIAOlGZmZGRghLJdgRjE
288AAz2uGDoaGLDqcFu0z4J9W9J85enNT+8X55W7G68/MPWihaPE0yn6Rpx2W1Ns
XioUvg+YMjHpmdTftQL/Cl31028tmPck9w23R/m9C4cduK8s+/BMrueUe1dJzLSy
0DVvXoaUcWuUSqWH9ep/mLpJMq1qxq68Lo1t23NSL6VVPuTUmXrRE8X0KRNZGKT+
rkMYnceCMPoNxOgyFKO7cAeKIAMzLAy8RXsN+Q4Z/GSu3p/katVcwb4Q6Ffswfj3
P0YwMoLV3weHzf8GcNjkuKNYy4tiLa64wBd7fwUwdECdCYmS+ZAoSVEBRQki0GLA
gQaKD8xAw+qkR6hOEmDoCc/PUWDIycxNLcpMzmYw27hRr59hG4OzNwsorJybKxb5
UhUYUdMwUOAkZ2+FOHo/0NHAeOY4ZCDAUr0X6PaTqGAbnIUtZN2FUUMWKbHXQwJX
AiNFfsBIkQ6lSfPzqAdO4gBbUXhncCkjH2yHMeAJiPp2EA12oPBAiZaGls0lS9cB
NP42rKpQASwRR2JP2zoQyg+7bA8FAFYeFKAXUUrg6gKjPGCAZS0+cNaCFgvg7DMR
ln2SbdCzzwGf+DuCoHxjjpRvMMvD/+fxFO7o9UYCtN6w6MqKuQyyQJ6wCgA=
=8ie6
-----END PGP MESSAGE-----
