• Bug#267147: sox can segfault when playing .wav

    From David M. Cooke@1:229/2 to All on Fri Aug 20 23:40:12 2004
    From: [email protected]

    This is a multi-part MIME message sent by reportbug.

    Package: sox
    Version: 12.17.5-2
    Severity: important
    Tags: patch

    I've been having a problem using sox on some WAV files. Specifically,
    the arrive.wav in the gaim package. This works

    $ sox arrive.wav -t ossdsp /dev/dsp
    ... sound plays ...

    but this doesn't:
    $ sox -v 0.25 arrive.wav -t ossdsp /dev/dsp
    Segmentation fault
    (and no sound)

    Rebuilding with nostrip and running under gdb tells me it was
    segfaulting in trying to free the comment field in wav.c:1091. This
    field was assigned the filename in sox.c:319.

    I wasn't able to determine exactly what the problem is (I'm suspecting
    some 32<->64 bit problems), because there doesn't seem to be anything
    that the volume changing *should* change, but the attached patch fixes
    the problem of trying to free unallocated memory in ft->comment. All assignments now to this field are done using allocated memory. There's
    probably now memory leaks where this isn't freed, but that's preferable
    to crashing.

    -- System Information:
    Debian Release: 3.1
    Architecture: amd64 (x86_64)
    Kernel: Linux 2.6.7-amd64
    Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8

    Versions of packages sox depends on:
    ii libc6 2.3.2.ds1-16 GNU C Library: Shared libraries an ii libmad0 0.15.1b-1 MPEG audio decoder library
    ii libogg0 1.1.0-1 Ogg Bitstream Library
    ii libvorbis0a 1.0.1-1 The Vorbis General Audio Compressi ii libvorbisenc2 1.0.1-1 The Vorbis General Audio Compressi ii libvorbisfile3 1.0.1-1 The Vorbis General Audio Compressi

    -- no debconf information

    diff -Naur sox-12.17.5-old/au.c sox-12.17.5/au.c
    --- sox-12.17.5-old/au.c 2004-08-20 17:02:44.245431832 -0400
    +++ sox-12.17.5/au.c 2004-08-20 17:04:24.348213896 -0400
    @@ -406,7 +406,7 @@
    * useful when there is no comments.
    */
    if (ft->comment == NULL)
    - ft->comment = "SOX";
    + ft->comment = strdup("SOX");

    hdr_size = SUN_HDRSIZE;

    --- sox-12.17.5-old/nulfile.c 2004-08-20 17:02:44.245431832 -0400
    +++ sox-12.17.5/nulfile.c 2004-08-20 17:04:05.908017232 -0400
    @@ -15,6 +15,7 @@
    *
    */

    +#include <string.h> /* Included for strcpy, strlen */
    #include <math.h>
    #include "st_i.h"

    @@ -48,7 +49,7 @@
    ft->info.encoding = ST_ENCODING_SIGN2;
    ft->info.channels = 2;
    }
    - ft->comment = "nul file";
    + ft->comment = strdup("nul file");

    /* only SIGINT will stop us from reading nul data..
    *
    --- sox-12.17.5-old/smp.c 2004-05-25 21:13:59.000000000 -0400
    +++ sox-12.17.5/smp.c 2004-08-20 17:08:21.183209504 -0400
    @@ -236,9 +236,11 @@
    for (co