Comments (4)
This bug is found in git commit 6e04bfa.
to reproduce the bug:
valgrind ./speexenc test.input -PoC input is attached.(this input is generated by fuzzer, the pdf suffix is to bypass github's upload regulation)
poc.pdf
Can't reproduce here, can you paste the output you're seeing with valgrind --track-origins=yes
?
from speex.
==14355== Memcheck, a memory error detector
==14355== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==14355== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==14355== Command: ./speexenc /home/bwang/Bowen/gitrepo/buddy-test-results/speexenc/monitor_out/input.17102 -
==14355== Parent PID: 10957
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484EC51: lpc_to_lsp (lsp.c:335)
==14355== by 0x4855C37: nb_encode (nb_celp.c:480)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484ECE5: lpc_to_lsp (lsp.c:352)
==14355== by 0x4855C37: nb_encode (nb_celp.c:480)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484EDA8: lpc_to_lsp (lsp.c:0)
==14355== by 0x4855C37: nb_encode (nb_celp.c:480)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484EDAD: lpc_to_lsp (lsp.c:0)
==14355== by 0x4855C37: nb_encode (nb_celp.c:480)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484BCE4: compute_rms (filters.c:315)
==14355== by 0x484BCE4: compute_rms16 (filters.c:319)
==14355== by 0x4855F87: nb_encode (nb_celp.c:561)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4CA1108: log (w_log_compat.c:31)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12BC8: __ieee754_log_fma (e_log.c:72)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12BD6: __ieee754_log_fma (e_log.c:82)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12C00: __ieee754_log_fma (e_log.c:88)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12C42: __ieee754_log_fma (e_log.c:123)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12C7A: __ieee754_log_fma (e_log.c:136)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12CD4: __ieee754_log_fma (e_log.c:142)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12CF4: __ieee754_log_fma (e_log.c:151)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12D1D: __ieee754_log_fma (e_log.c:152)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12D5D: __ieee754_log_fma (e_log.c:155)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12280: __ieee754_exp_fma (e_exp.c:68)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D122B5: __ieee754_exp_fma (e_exp.c:103)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12598: __ieee754_exp_fma (e_exp.c:124)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D125AA: __ieee754_exp_fma (e_exp.c:125)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D125B8: __ieee754_exp_fma (e_exp.c:124)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D125BE: __ieee754_exp_fma (e_exp.c:125)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4CA18B1: exp (w_exp_compat.c:30)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4CA18BB: exp (w_exp_compat.c:30)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4CA18C8: exp (w_exp_compat.c:30)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4854224: scal_quant (vq.c:54)
==14355== by 0x485767D: nb_encode (nb_celp.c:966)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4853E8E: vq_nbest (vq_sse.h:59)
==14355== by 0x4848C27: split_cb_search_shape_sign (cb_search.c:389)
==14355== by 0x485777C: nb_encode (nb_celp.c:987)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4853E52: vq_nbest (vq_sse.h:57)
==14355== by 0x4848C27: split_cb_search_shape_sign (cb_search.c:389)
==14355== by 0x485777C: nb_encode (nb_celp.c:987)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4848C86: split_cb_search_shape_sign (cb_search.c:398)
==14355== by 0x485777C: nb_encode (nb_celp.c:987)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4848CA9: split_cb_search_shape_sign (cb_search.c:402)
==14355== by 0x485777C: nb_encode (nb_celp.c:987)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484FC24: open_loop_nbest_pitch (ltp.c:266)
==14355== by 0x484FEE3: pitch_search_3tap (ltp.c:614)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484FC67: open_loop_nbest_pitch (ltp.c:275)
==14355== by 0x484FEE3: pitch_search_3tap (ltp.c:614)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4850EC4: pitch_gain_search_3tap_vq (ltp.c:338)
==14355== by 0x4850EC4: pitch_gain_search_3tap (ltp.c:489)
==14355== by 0x484FFD1: pitch_search_3tap (ltp.c:626)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4850EEA: pitch_gain_search_3tap (ltp.c:497)
==14355== by 0x484FFD1: pitch_search_3tap (ltp.c:626)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4850F2B: pitch_gain_search_3tap (ltp.c:498)
==14355== by 0x484FFD1: pitch_search_3tap (ltp.c:626)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484FFE5: pitch_search_3tap (ltp.c:628)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484FFEA: pitch_search_3tap (ltp.c:628)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x48500B0: pitch_search_3tap (ltp.c:643)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484BCE4: compute_rms (filters.c:315)
==14355== by 0x484BCE4: compute_rms16 (filters.c:319)
==14355== by 0x4857638: nb_encode (nb_celp.c:946)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x489FFC1: ogg_page_checksum_set (in /usr/lib/x86_64-linux-gnu/libogg.so.0.8.2)
==14355== by 0x48A17A9: ogg_stream_pageout (in /usr/lib/x86_64-linux-gnu/libogg.so.0.8.2)
==14355== by 0x403C6F: main (speexenc.c:919)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x4848545: split_cb_search_shape_sign (cb_search.c:339)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4B329C7: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1226)
==14355== by 0x4B271D7: fwrite (iofwrite.c:39)
==14355== by 0x403CBE: oe_write_page (speexenc.c:77)
==14355== by 0x403CBE: main (speexenc.c:921)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x4848545: split_cb_search_shape_sign (cb_search.c:339)
==14355==
==14355== Syscall param write(buf) points to uninitialised byte(s)
==14355== at 0x4BB0FD4: write (write.c:26)
==14355== by 0x4B3233C: _IO_file_write@@GLIBC_2.2.5 (fileops.c:1188)
==14355== by 0x4B33A70: new_do_write (fileops.c:456)
==14355== by 0x4B33A70: _IO_do_write@@GLIBC_2.2.5 (fileops.c:433)
==14355== by 0x4B35B81: _IO_flush_all_lockp (genops.c:706)
==14355== by 0x4B35D84: _IO_cleanup (genops.c:858)
==14355== by 0x4AEB519: __run_exit_handlers (exit.c:130)
==14355== by 0x4AEB559: exit (exit.c:139)
==14355== by 0x4ACB0A1: (below main) (libc-start.c:342)
==14355== Address 0x4e29208 is 200 bytes inside a block of size 1,024 alloc'd
==14355== at 0x483774F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14355== by 0x4B25C9B: _IO_file_doallocate (filedoalloc.c:101)
==14355== by 0x4B34EC1: _IO_doallocbuf (genops.c:347)
==14355== by 0x4B33FC7: _IO_file_overflow@@GLIBC_2.2.5 (fileops.c:752)
==14355== by 0x4B32A14: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1251)
==14355== by 0x4B271D7: fwrite (iofwrite.c:39)
==14355== by 0x40379E: oe_write_page (speexenc.c:76)
==14355== by 0x40379E: main (speexenc.c:780)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x4848545: split_cb_search_shape_sign (cb_search.c:339)
==14355==
==14355==
==14355== HEAP SUMMARY:
==14355== in use at exit: 0 bytes in 0 blocks
==14355== total heap usage: 10 allocs, 10 frees, 39,616 bytes allocated
==14355==
==14355== All heap blocks were freed -- no leaks are possible
==14355==
==14355== For counts of detected and suppressed errors, rerun with: -v
==14355== ERROR SUMMARY: 6262 errors from 41 contexts (suppressed: 0 from 0)
from speex.
Ah ok I was able to reproduce on 5dceaaf with:
valgrind --track-origins=yes src/.libs/speexenc ~/Downloads/poc.wav - > bob.spx
The issue is that the input buffer in speexenc
is not initialized, I will post fix on https://gitlab.xiph.org/xiph/speex
from speex.
Ah ok I was able to reproduce on 5dceaaf with:
valgrind --track-origins=yes src/.libs/speexenc ~/Downloads/poc.wav - > bob.spx
The issue is that the input buffer in
speexenc
is not initialized, I will post fix on https://gitlab.xiph.org/xiph/speex
https://gitlab.xiph.org/xiph/speex/-/merge_requests/7
from speex.
Related Issues (14)
- Some question about code in speex_jitter_buffer.c HOT 2
- speexenc encode wav file dos vulnerability HOT 2
- speexenc stack buffer overflow HOT 5
- Hi,Is the speex component being maintained? HOT 2
- Speex preprocessor? HOT 1
- Frame Size time
- Veracode scan complains the calloc is not checked for return value HOT 4
- Difficulty in compiling HOT 1
- Real-time conversion pcm problem of voice stream in speex format
- bash : speexenc not found
- Speex decoder is vulnerable HOT 3
- Add CMake build system HOT 1
- speexenc hangs on corrupted input file HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from speex.