April 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1157912] New: awk: cmd. line:18: warning: regexp escape sequence `\"' is not a known regexp operator
by bugzilla_noreply＠novell.com 28 Jul '22

28 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1157912 Bug ID: 1157912 Summary: awk: cmd. line:18: warning: regexp escape sequence `\"' is not a known regexp operator Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: jsrain(a)suse.com Reporter: ohering(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Tumbleweed 20191124, in my autoyast post install no grub.cfg is generated: + grub2-mkconfig -o /boot/grub2/grub.cfg Generating grub configuration file ... Found linux image: /boot/vmlinuz-5.3.12-1-default Found initrd image: /boot/initrd-5.3.12-1-default Found hypervisor: /boot/xen-4.13.0_02-1.gz Found linux image: /boot/vmlinuz-5.3.12-1-default Found initrd image: /boot/initrd-5.3.12-1-default awk: cmd. line:18: warning: regexp escape sequence `\"' is not a known regexp operator awk: cmd. line:18: warning: regexp escape sequence `\"' is not a known regexp operator cp: -r not specified; omitting directory '/boot/' bash -x $(type -P grub2-mkconfig) -o /boot/grub2/grub.cfg ... + echo '### BEGIN /etc/grub.d/20_linux_xen ###' + /etc/grub.d/20_linux_xen Found hypervisor: /boot/xen-4.13.0_02-1.gz Found linux image: /boot/vmlinuz-5.3.12-1-default Found initrd image: /boot/initrd-5.3.12-1-default awk: cmd. line:18: warning: regexp escape sequence `\"' is not a known regexp operator awk: cmd. line:18: warning: regexp escape sequence `\"' is not a known regexp operator cp: -r not specified; omitting directory '/boot/' -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1161435] New: 5.4.10-1-default doesn't boot on Panda
by bugzilla_noreply＠novell.com 28 Jul '22

28 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1161435 Bug ID: 1161435 Summary: 5.4.10-1-default doesn't boot on Panda Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: armv7 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: schwab(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Loading Linux 5.4.10-1-default ... Loading initial ramdisk ... EFI stub: Booting Linux Kernel... EFI stub: Using DTB from configuration table EFI stub: Exiting boot services and installing virtual address map... data abort pc : [<bff6545a>] lr : [<bff65491>] reloc pc : [<8080045a>] lr : [<80800491>] sp : bdf43ed4 ip : 00000000 fp : 00000000 r10: bff65000 r9 : bdf44ed0 r8 : 20071040 r7 : bff656e0 r6 : bff65694 r5 : 000000ad r4 : 200856e0 r3 : 00000000 r2 : 00000050 r1 : bff65690 r0 : abb1aaad Flags: NzCv IRQs off FIQs off Mode SVC_32 Code: ea83428a d1f52010 f856bdf0 40685b04 (f854b2c5) UEFI image [0xbcf20000:0xbcf3bfff] '/VenHw(e61d73b9-a384-4acc-aeab-82e828f3628b)/USB(0x6,0x0)/HD(1,GPT,216dc377-761b-4afe-a951-fe9dc892afb6,0x800000000000,0xbcf2943000000000)/\efi\boot\bootarm.efi' UEFI image [0xaca8a000:0xad2e7fff] Resetting CPU ... resetting ... U-Boot SPL 2019.01 (Mar 18 2019 - 11:17:54 +0000) OMAP4430-GP ES2.2 Trying to boot from MMC1 SPL: Please implement spl_start_uboot() for your board SPL: Direct Linux boot not active! U-Boot 2019.01 (Mar 18 2019 - 11:17:54 +0000) CPU : OMAP4430-GP ES2.2 Board: OMAP4 Panda I2C: ready DRAM: 1 GiB MMC: OMAP SD/MMC: 0 Loading Environment from FAT... *** Warning - bad CRC, using default environment Net: No ethernet found. Hit any key to stop autoboot: 0 -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1157019] New: RPi3: no grub menu on serial console
by bugzilla_noreply＠novell.com 28 Jul '22

28 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1157019 Bug ID: 1157019 Summary: RPi3: no grub menu on serial console Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: jsrain(a)suse.com Reporter: mbrugger(a)suse.com QA Contact: jsrain(a)suse.com CC: afaerber(a)suse.com, guillaume.gardet(a)arm.com, jlee(a)suse.com, yousaf.kaukab(a)suse.com Found By: --- Blocker: --- When booting RPi3 image without a monitor connected, the system does not show any output on the serial console when starting grub. As a result we can't change the kernel console parameter neither. Expected behaviour: A message like: "Please press 't' to show the boot menu on this console" should be shown on the serial console that will allow us to switch to serial console grub menu. Actual behaviour: No output from grub2 on the serial console. Kernel get's started without the posibility to interact with grub2 through the serial console. Tested with: openSUSE-Tumbleweed-JeOS.aarch64-15.1.0-RaspberryPi-Build9.29.raw.xz from Virtualization:Appliances:Images:openSUSE-Tumbleweed/kiwi-templates-JeOS -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1163599] New: generated grub.cfg points to non-existent kernel images
by bugzilla_noreply＠novell.com 28 Jul '22

28 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1163599 Bug ID: 1163599 Summary: generated grub.cfg points to non-existent kernel images Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: jsrain(a)suse.com Reporter: mcepl(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Created attachment 830064 --> http://bugzilla.suse.com/attachment.cgi?id=830064&action=edit Output of supportconfig grub2-mkconfig generates invalid /boot/grub2/grub.cfg, because it expects both kernel image and ramdisk image to be in some kind of BTRFS snapshot, not directly in the /boot directory itself. See attached output of supportconfig and generated grub.cfg. -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1156441] New: grub2-install does not setup env_block for btrfs
by bugzilla_noreply＠novell.com 28 Jul '22

28 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1156441 Bug ID: 1156441 Summary: grub2-install does not setup env_block for btrfs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: mchang(a)suse.com Reporter: fvogt(a)suse.com QA Contact: jsrain(a)suse.com CC: arvidjaar(a)gmail.com Found By: --- Blocker: --- Some grub2 configs rely on being able to read and write certain environment variables (like health_checker_flag), but this only works if grub2-editenv was called previously. grub2-install should take care of setting up the env_block for systems which need it, if it doesn't exist yet. -- You are receiving this mail because: You are on the CC list for the bug.

2 22

[Bug 1148809] New: yast2 bootloader fails when lvmcache is in use
by bugzilla_noreply＠novell.com 28 Jul '22

28 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1148809 Bug ID: 1148809 Summary: yast2 bootloader fails when lvmcache is in use Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: aspiers(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- [ Originally reported at: https://github.com/openSUSE/libstorage-ng/issues/664 ] I added an lvmcache cachepool to the LV for my root filesystem, and now YaST's bootloader module fails due to not being able to detect the root filesystem. How to reproduce: 1. Start with lvmcache disabled (i.e. normal LVM / filesystem, backed by mdraid) 2. Observe `yast2 bootloader` works fine 3. Activate the cache LV which I previously setup: lvconvert --type cache --cachepool system/cache-root system/root 4. Run `yast2 bootloader` again 5. Observe that an Error dialog pops up, filled with a) lots of (apparently harmless) warnings about an fd leak, and b) an error right at the end showing that it cannot find the disk by LVM UUID: Execution of command "[["/usr/bin/grub2-editenv", "list"]]" failed. Exit code: 1 Error output: File descriptor 7 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 8 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 9 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 10 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 7 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 8 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 9 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 10 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 7 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 8 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 9 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 10 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 7 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 8 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 9 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 10 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 7 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 8 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 9 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 10 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 7 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 8 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 9 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 10 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 7 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 8 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 9 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 10 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 7 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 8 (pipe:[4428632]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 9 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv File descriptor 10 (pipe:[4428633]) leaked on vgs invocation. Parent PID 18319: /usr/bin/grub2-editenv /usr/bin/grub2-editenv: error: disk `lvmid/m4f2UJ-widt-pyk9-QkKY-KyJQ-pbwq-V8zzwL/MsUIK0-r51d-MJck-aQwk-ZiAS-A2BI-XdT2vl' not found. 6. Click OK (the only available button) on this dialog 7. Now I see the same dialog I originally reported at the top of this issue. 8. Click `Continue` 9. Observe another dialog: Probing file system with UUID cad8b62c-88e5-4c19-ad24-06e75c0a8987 failed Unexpected situation found in the system. Click below to see more details (English only). Continue despite the error? Continue Abort Details 10. Clicking `Details` shows: device not found, name:/dev/mapper/system-root 11. Click `OK` then `Continue` to continue despite the error 12. Observe another error dialog: Internal error. Please report a bug report with logs. Run save_y2logs to get complete logs. Caller: /usr/share/YaST2/modules/BootStorage.rb:246:in `detect_disks' Details: Missing '/' mount point 13. Click `OK` and yast exits. Clearly there is some side effect of attaching the cache LV which somehow confuses the disk detection code. I see in the error above that it's looking for `lvmid/m4f2UJ-widt-pyk9-QkKY-KyJQ-pbwq-V8zzwL/MsUIK0-r51d-MJck-aQwk-ZiAS-A2BI-XdT2vl`, which seems to correspond OK to the uuids shown here: # dmsetup info system-root Name: system-root State: ACTIVE Read Ahead: 1024 Tables present: LIVE Open count: 1 Event number: 0 Major, minor: 254, 0 Number of targets: 1 UUID: LVM-m4f2UJwidtpyk9QkKYKyJQpbwqV8zzwLMsUIK0r51dMJckaQwkZiASA2BIXdT2vl # lvdisplay system/root --- Logical volume --- LV Path /dev/system/root LV Name root VG Name system LV UUID MsUIK0-r51d-MJck-aQwk-ZiAS-A2BI-XdT2vl LV Write Access read/write LV Creation host, time install, 2018-12-31 13:15:41 +0000 LV Cache pool name cache-root LV Cache origin name root_corig LV Status available # open 1 LV Size 500.00 GiB Cache used blocks 0.04% Cache metadata blocks 6.47% Cache dirty blocks 0.00% Cache read hits/misses 2 / 15 Cache wrt hits/misses 653 / 572 Cache demotions 0 Cache promotions 336 Current LE 128000 Segments 1 Allocation inherit Read ahead sectors auto - currently set to 1024 Block device 254:0 -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 1138858] New: grub2 dns unreliable
by bugzilla_noreply＠novell.com 28 Jul '22

28 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1138858 Bug ID: 1138858 Summary: grub2 dns unreliable Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: msuchanek(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- On powerpc DNS resolution does not always work: IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM GNU GRUB version 2.02 Minimal BASH-like line editing is supported. For the first word, TAB GNU GRUB version 2.02 Minimal BASH-like line editing is supported. For the first word, TAB lists possible command completions. Anywhere else TAB lists possible device or file completions. grub> insmod http grub> net_add_dns 10.160.0.1 grub> linux (http,download.suse.de)/install/SLP/SLE-12-SP4-Server-GM/ppc64le/DVD 1/boot/ppc64le/linux install=http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/ppc64le/DVD1 error: no DNS reply received. grub> net_add_dns 10.160.0.100 grub> linux (http,download.suse.de)/install/SLP/SLE-12-SP4-Server-GM/ppc64le/DV D1/boot/ppc64le/linux install=http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/ppc64le/DVD1 error: no DNS reply received. grub> linux (http,download.suse.de)/install/SLP/SLE-12-SP4-Server-GM/ppc64le/DV D1/boot/ppc64le/linux install=http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/ppc64le/DVD1 grub> initrd (http,download.suse.de)/install/SLP/SLE-12-SP4-Server-GM/ppc64le/DVD1/boot/ppc64le/initrd grub> boot Is this known issue? How do I tell which exact grub version I have? -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1036969] New: VUL-1: libmad: assertion failure in layer3.c
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036969 Bug ID: 1036969 Summary: VUL-1: libmad: assertion failure in layer3.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723246 --> http://bugzilla.opensuse.org/attachment.cgi?id=723246&action=edit 00213-libmad-heapoverflow-mad_layer_III_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-… ================================================ Description: libmad stays for “M”peg “A”udio “D”ecoder library. The same testcase provided in the article: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) is able to show an assertion failure if libmad was compiled with debug (–enable-debugging). The complete output of the failure: # madplay -v -i -o raw:out $FILE madplay: /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2633: mad_layer_III: Assertion `stream->md_len + md_len - si.main_data_begin <= MAD_BUFFER_MDLEN' failed. Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00213-libmad-heapoverflow-mad_l… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. ================================================ (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1036968] New: VUL-1: libmad: heap-based buffer overflow in mad_layer_III (layer3.c)
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036968 Bug ID: 1036968 Summary: VUL-1: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723245 --> http://bugzilla.opensuse.org/attachment.cgi?id=723245&action=edit 00213-libmad-heapoverflow-mad_layer_III_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-i… ====================================================== Description: libmad stays for “M”peg “A”udio “D”ecoder library. There is an heap overflow discovered through madplay. The complete ASan output: # madplay -v -i -o raw:out $FILE ==14773==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e00000fa87 at pc 0x0000004bc8ec bp 0x7ffcda3263d0 sp 0x7ffcda325b80 WRITE of size 2060 at 0x61e00000fa87 thread T0 #0 0x4bc8eb in __asan_memcpy /tmp/portage/sys-devel/llvm-3.9.1-r1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413 #1 0x7f37ddfa397d in mad_layer_III /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2635:2 #2 0x7f37ddf6784d in mad_frame_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/frame.c:453:7 #3 0x7f37ddf8c4e4 in run_sync /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:404:11 #4 0x7f37ddf8ac59 in mad_decoder_run /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:557:12 #5 0x5277a1 in decode /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1862:12 #6 0x5277a1 in play_one /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1951 #7 0x5277a1 in play_all /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2041 #8 0x5215a2 in player_run /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2768:14 #9 0x50c46c in main /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/madplay.c:816:7 #10 0x7f37dce4f78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #11 0x41aa78 in _init (/usr/bin/madplay+0x41aa78) Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00213-libmad-heapoverflow-mad_l… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) ====================================================== (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1036967] New: VUL-1: libmad: heap-based buffer overflow in mad_bit_skip (bit.c)
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036967 Bug ID: 1036967 Summary: VUL-1: libmad: heap-based buffer overflow in mad_bit_skip (bit.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723244 --> http://bugzilla.opensuse.org/attachment.cgi?id=723244&action=edit 00211-libmad-heapoverflow-mad_bit_skip_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-i… =========================================================== Description: libmad stays for “M”peg “A”udio “D”ecoder library. There is an heap overflow discovered through madplay. The complete ASan output: # madplay -v -i -o raw:out $FILE ==12603==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000c09f at pc 0x7f72d6aa05c0 bp 0x7fff03e32040 sp 0x7fff03e32038 READ of size 1 at 0x61200000c09f thread T0 #0 0x7f72d6aa05bf in mad_bit_skip /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/bit.c:130:21 #1 0x7f72d6b032ad in III_huffdecode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:953:3 #2 0x7f72d6b032ad in III_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2403 #3 0x7f72d6af1a8e in mad_layer_III /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2648:13 #4 0x7f72d6ab584d in mad_frame_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/frame.c:453:7 #5 0x7f72d6ada4e4 in run_sync /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:404:11 #6 0x7f72d6ad8c59 in mad_decoder_run /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:557:12 #7 0x5277a1 in decode /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1862:12 #8 0x5277a1 in play_one /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1951 #9 0x5277a1 in play_all /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2041 #10 0x5215a2 in player_run /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2768:14 #11 0x50c46c in main /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/madplay.c:816:7 #12 0x7f72d599d78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #13 0x41aa78 in _init (/usr/bin/madplay+0x41aa78) Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00211-libmad-heapoverflow-mad_b… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: libmad: heap-based buffer overflow in mad_bit_skip (bit.c) =========================================================== (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 3