Bug#861908: gsequencer: testsuite crashes if AddressSanitizer is enabled

[James Cowgill]

Source: gsequencer
Version: 0.8.0-1
Severity: important

Hi,

While looking at #861645 I noticed that the gsequencer testsuite
crashes on x86 with a heap buffer overflow when AddressSanitizer
(-fsanitize=address) is enabled.


FAIL: ags_midi_buffer_util_test
===============================



     CUnit - A unit testing framework for C - Version 2.1-3
     http://cunit.sourceforge.net/


Suite: AgsMidiBufferUtilTest
  Test: test of ags_midi_buffer_util.c get varlength size ...passed
  Test: test of ags_midi_buffer_util.c put varlength ...passed
  Test: test of ags_midi_buffer_util.c get varlength ...passed
  Test: test of ags_midi_buffer_util.c put int16 ...passed
  Test: test of ags_midi_buffer_util.c get int16 ...passed
  Test: test of ags_midi_buffer_util.c put int24 ...passed
  Test: test of ags_midi_buffer_util.c get int24 ...passed
  Test: test of ags_midi_buffer_util.c put int32 ...passed
  Test: test of ags_midi_buffer_util.c get int32 ...passed
  Test: test of ags_midi_buffer_util.c put header ...
** (process:4236): WARNING **: invalid chunk length

** (process:4236): WARNING **: invalid chunk length
FAILED
    1. ags/test/audio/midi/ags_midi_buffer_util_test.c:518  - success == TRUE
    2. ags/test/audio/midi/ags_midi_buffer_util_test.c:535  - success == TRUE
  Test: test of ags_midi_buffer_util.c get header ...passed
  Test: test of ags_midi_buffer_util.c put track ...passed
  Test: test of ags_midi_buffer_util.c get track ...passed
  Test: test of ags_midi_buffer_util.c put key on ...passed
  Test: test of ags_midi_buffer_util.c get key on ...passed
  Test: test of ags_midi_buffer_util.c put key off ...passed
  Test: test of ags_midi_buffer_util.c get key off ...passed
  Test: test of ags_midi_buffer_util.c put key pressure ...passed
  Test: test of ags_midi_buffer_util.c get key pressure ...passed
  Test: test of ags_midi_buffer_util.c put change parameter ...passed
  Test: test of ags_midi_buffer_util.c get change parameter ...passed
  Test: test of ags_midi_buffer_util.c put change pitch bend ...passed
  Test: test of ags_midi_buffer_util.c get change pitch bend ...passed
  Test: test of ags_midi_buffer_util.c put change program ...FAILED
    1. ags/test/audio/midi/ags_midi_buffer_util_test.c:1044  - success == TRUE
  Test: test of ags_midi_buffer_util.c get change program ...=================================================================
==4236==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dff6 at pc 0x7f0b047bfd7b bp 0x7fff86d9a050 sp 0x7fff86d99800
WRITE of size 3 at 0x60200000dff6 thread T0
    #0 0x7f0b047bfd7a  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
    #1 0x5618bff665ad in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
    #2 0x5618bff665ad in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1073
    #3 0x7f0b03741396  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4396)
    #4 0x7f0b037416cf  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x46cf)
    #5 0x7f0b03741a1d in CU_run_all_tests (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4a1d)
    #6 0x5618bff63203 in main ags/test/audio/midi/ags_midi_buffer_util_test.c:3257
    #7 0x7f0b00fdb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #8 0x5618bff63269 in _start (/build/gsequencer-8YtPr4/gsequencer-0.8.0/.libs/ags_midi_buffer_util_test+0x7269)

0x60200000dff6 is located 0 bytes to the right of 6-byte region [0x60200000dff0,0x60200000dff6)
allocated by thread T0 here:
    #0 0x7f0b04824d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x5618bff663ff in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1057

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a) 
Shadow bytes around the buggy address:
  0x0c047fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[06]fa
  0x0c047fff9c00: fa fa 00 00 fa fa 06 fa fa fa 07 fa fa fa 07 fa
  0x0c047fff9c10: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
  0x0c047fff9c20: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
  0x0c047fff9c30: fa fa 00 fa fa fa 00 00 fa fa fd fa fa fa fd fa
  0x0c047fff9c40: fa fa 00 00 fa fa 00 07 fa fa 00 07 fa fa 04 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4236==ABORTING

James

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/attachments/20170505/6b22155f/attachment.sig>