[asterisk-bugs] [JIRA] Closed: (ASTERISK-20482) Certain mp3 file will cause crash in format_mp3.c

[Matt Jordan (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-20482?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matt Jordan closed ASTERISK-20482.
----------------------------------

    Resolution: Duplicate

This is a duplicate of ASTERISK-19761, which was fixed in r366296.  Asterisk 1.8.14.0 and later should contain this fix.

> Certain mp3 file will cause crash in format_mp3.c
> -------------------------------------------------
>
>                 Key: ASTERISK-20482
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-20482
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Addons/format_mp3
>    Affects Versions: 1.8.11.1
>            Reporter: Martin Vit
>            Severity: Critical
>         Attachments: paycomtest.mp3
>
>
> CLI> file convert /tmp/1.mp3 /tmp/1.wav (the file is attached here in tracker) 
> Valgrind output: 
> ==18890== Invalid read of size 1
> ==18890==    at 0x217867E8: mp3_read (format_mp3.c:215)
> ==18890==    by 0x4CDED4: read_frame (file.c:719)
> ==18890==    by 0x4CDF64: ast_readframe (file.c:740)
> ==18890==    by 0x139FC251: handle_cli_file_convert (res_convert.c:122)
> ==18890==    by 0x48FB2B: ast_cli_command_full (cli.c:2502)
> ==18890==    by 0x43F9BE: consolehandler (asterisk.c:1862)
> ==18890==    by 0x446632: main (asterisk.c:3980)
> ==18890==  Address 0x8792540 is 0 bytes after a block of size 63,024 alloc'd
> ==18890==    at 0x4C2380C: calloc (vg_replace_malloc.c:467)
> ==18890==    by 0x569A13: _ast_calloc (utils.h:480)
> ==18890==    by 0x446CFE: internal_ao2_alloc (astobj2.c:300)
> ==18890==    by 0x446E77: __ao2_alloc (astobj2.c:344)
> ==18890==    by 0x4CD00C: get_filestream (file.c:360)
> ==18890==    by 0x4CEC13: ast_readfile (file.c:1018)
> ==18890==    by 0x139FC093: handle_cli_file_convert (res_convert.c:106)
> ==18890==    by 0x48FB2B: ast_cli_command_full (cli.c:2502)
> ==18890==    by 0x43F9BE: consolehandler (asterisk.c:1862)
> ==18890==    by 0x446632: main (asterisk.c:3980)
> GDB output: 
> #0  0x00007f1be0a467e8 in mp3_read (s=0x7f1bf80c6318, whennext=0x7fffb9d367ec) at format_mp3.c:215
>         p = 0x7f1bf80c6588
>         delay = 0
>         save = 0
> #1  0x00000000004cded5 in read_frame (s=0x7f1bf80c6318, whennext=0x7fffb9d367ec) at file.c:719
>         fr = 0x2913e80
>         new_fr = 0x2906690
> #2  0x00000000004cdf65 in ast_readframe (s=0x7f1bf80c6318) at file.c:740
>         whennext = 0
> #3  0x00007f1bee7fa252 in handle_cli_file_convert (e=0x7f1bee9fad20, cmd=-4, a=0x7fffb9d36980) at res_convert.c:122
>         ret = 0x2 <Address 0x2 out of bounds>
>         fs_in = 0x7f1bf80c6318
>         fs_out = 0x7f1bf8097ba8
>         f = 0x2913e80
>         start = {tv_sec = 1348666762, tv_usec = 541456}
>         cost = 32767
>         file_in = 0x7fffb9d36830 "/tmp/1"
>         file_out = 0x7fffb9d36810 "/tmp/1"
>         name_in = 0x7fffb9d36830 "/tmp/1"
>         ext_in = 0x7fffb9d36837 "mp3"
>         name_out = 0x7fffb9d36810 "/tmp/1"
>         ext_out = 0x7fffb9d36817 "wav"

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira