Project: libsndfile (libsndfile/libsndfile), language: c++
Vulnerability instance: libsndfile.cve-2018-13419

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/erikd/libsndfile/issues/398
## Description:
Issue: erikd/libsndfile#398
Title: memory leaks detected
State: closed
Created by: fCorleone
Created at: 2018-07-05 10:23:37+00:00

Issue Body:
=================================================================
==11731==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 12736 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6f0279a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x7ffff6b3deb7 in psf_allocate src/common.c:45

Indirect leak of 3672 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6f02961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x7ffff6b4fb24 in psf_bump_header_allocation src/common.c:70
    #2 0x7ffff6b4fb24 in header_seek src/common.c:886
    #3 0x7ffff6b4fb24 in psf_binheader_readf src/common.c:1121

Indirect leak of 1920 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6f0279a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x7ffff6bfe0a0 in psf_store_read_chunk src/chunk.c:114
    #2 0x7ffff6bfe0a0 in psf_store_read_chunk_u32 src/chunk.c:151
    #3 0x7ffff6c35117  (/usr/local/lib/libsndfile.so.1+0x260117)

Indirect leak of 528 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6f0279a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x7ffff6aaed7f in wav_open src/wav.c:163

Indirect leak of 256 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6f02961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x7ffff6be8116 in psf_store_string src/strings.c:134
The command line is ./sndfile-convert ./2.wav ./out.prc where 2.wav is just a simple wav file.



Comments:
Comment by erikd on 2018-07-06 22:26:54+00:00:
What version of libsndfile is this? Is this, or have you tried current git HEAD?

It would also be useful for you to post the `sndfile-info` output for that file.

---

Comment by carnil on 2018-07-08 08:37:47+00:00:
This issue was assigned [CVE-2018-13419](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13419)

---

Comment by sgayou on 2018-07-09 16:38:24+00:00:
Unable to reproduce this on libsndfile-1.0.28 with a clang fsanitize=leak build. Seems like the convert operation will only complete with the input wav has a single channel. The wav file used to trigger the leak would be useful in addition to the lsan log.

./sndfile-convert -endian=little -alaw tone.wav test.prc

No dice in valgrind either. Let me know if anyone else has more success.

---

Comment by abergmann on 2018-11-27 07:19:49+00:00:
@fCorleone any chance to publish the reproducer here? Thanks!

---

Comment by erikd on 2019-01-02 09:20:49+00:00:
Closing this for now. If a file can be provided that triggers this issue please feel free to re-open.

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN git clone https://github.com/libsndfile/libsndfile libsndfile
RUN git -C libsndfile checkout 1d928bffdb65e827c3e7d17ece0e123b4a70ec6c
WORKDIR $SRC/libsndfile
COPY build.sh $SRC/

Additional files: