github-starred/libxlsxwriter
2
0
Fork 0
mirror of https://github.com/jmcnamara/libxlsxwriter.git synced 2026-05-15 14:15:54 -06:00
Code Issues 16 Projects Packages Wiki Activity Actions

[GH-ISSUE #446] _store_array_formula heap-buffer-overflow #349

New issue
Closed
opened 2026-05-05 12:11:20 -06:00 by gitea-mirror · 5 comments
gitea-mirror commented 2026-05-05 12:11:20 -06:00
Owner
Copy link

Originally created by @ym-xie on GitHub (May 22, 2024).
Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/446

maybe there exist a bug in worksheet_write_dynamic_formula and worksheet_write_dynamic_array_formula.
Below is an example


#include <xlsxwriter/workbook.h>
#include <xlsxwriter/worksheet.h>

int main() {

    lxw_workbook  *workbook  = workbook_new("demo.xlsx");
    lxw_worksheet *worksheet = workbook_add_worksheet(workbook, NULL);


    lxw_error err = worksheet_write_dynamic_formula(worksheet, 0, 0, "", NULL);
    // Also
    // worksheet_write_dynamic_array_formula(worksheet, 0, 0, 0, 0, "", NULL);
    if (err != LXW_NO_ERROR)
        return 1;

    workbook_close(workbook);

    return 0;
}

Below is asan information:

=================================================================
==2675438==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000004af at pc 0x562869d4a523 bp 0x7fff05004f30 sp 0x7fff05004f28
READ of size 1 at 0x6020000004af thread T0
    #0 0x562869d4a522 in _store_array_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8075:9
    #1 0x562869d4adb5 in worksheet_write_dynamic_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8146:12
    #2 0x562869ce06a8 in main /home/ubuntu/workspace/newest-libxlsxwriter/build/../bugs/bug8.cpp:11:21
    #3 0x7fca4046ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #4 0x7fca4046ee3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #5 0x562869c20454 in _start (/home/ubuntu/workspace/newest-libxlsxwriter/build/bug8+0x58454) (BuildId: e40ae509915daf6c86a9e328bddaa36cd11cb982)

0x6020000004af is located 1 bytes to the left of 1-byte region [0x6020000004b0,0x6020000004b1)
allocated by thread T0 here:
    #0 0x562869ca329e in malloc (/home/ubuntu/workspace/newest-libxlsxwriter/build/bug8+0xdb29e) (BuildId: e40ae509915daf6c86a9e328bddaa36cd11cb982)
    #1 0x562869e45ed8 in lxw_strdup /home/ubuntu/workspace/newest-libxlsxwriter/src/utility.c:471:12
    #2 0x562869e4600f in lxw_strdup_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/utility.c:489:16
    #3 0x562869d4a4b5 in _store_array_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8072:24
    #4 0x562869d4adb5 in worksheet_write_dynamic_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8146:12
    #5 0x562869ce06a8 in main /home/ubuntu/workspace/newest-libxlsxwriter/build/../bugs/bug8.cpp:11:21
    #6 0x7fca4046ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8075:9 in _store_array_formula
Shadow bytes around the buggy address:
  0x0c047fff8040: fa fa 00 00 fa fa 00 00 fa fa 00 fa fa fa 07 fa
  0x0c047fff8050: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8060: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8070: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8080: fa fa 00 00 fa fa 00 00 fa fa 00 fa fa fa 00 fa
=>0x0c047fff8090: fa fa 00 fa fa[fa]01 fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2675438==ABORTING
Originally created by @ym-xie on GitHub (May 22, 2024). Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/446 maybe there exist a bug in `worksheet_write_dynamic_formula` and `worksheet_write_dynamic_array_formula`. Below is an example ```cpp #include <xlsxwriter/workbook.h> #include <xlsxwriter/worksheet.h> int main() { lxw_workbook *workbook = workbook_new("demo.xlsx"); lxw_worksheet *worksheet = workbook_add_worksheet(workbook, NULL); lxw_error err = worksheet_write_dynamic_formula(worksheet, 0, 0, "", NULL); // Also // worksheet_write_dynamic_array_formula(worksheet, 0, 0, 0, 0, "", NULL); if (err != LXW_NO_ERROR) return 1; workbook_close(workbook); return 0; } ``` Below is asan information: ```shell ================================================================= ==2675438==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000004af at pc 0x562869d4a523 bp 0x7fff05004f30 sp 0x7fff05004f28 READ of size 1 at 0x6020000004af thread T0 #0 0x562869d4a522 in _store_array_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8075:9 #1 0x562869d4adb5 in worksheet_write_dynamic_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8146:12 #2 0x562869ce06a8 in main /home/ubuntu/workspace/newest-libxlsxwriter/build/../bugs/bug8.cpp:11:21 #3 0x7fca4046ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #4 0x7fca4046ee3f in __libc_start_main csu/../csu/libc-start.c:392:3 #5 0x562869c20454 in _start (/home/ubuntu/workspace/newest-libxlsxwriter/build/bug8+0x58454) (BuildId: e40ae509915daf6c86a9e328bddaa36cd11cb982) 0x6020000004af is located 1 bytes to the left of 1-byte region [0x6020000004b0,0x6020000004b1) allocated by thread T0 here: #0 0x562869ca329e in malloc (/home/ubuntu/workspace/newest-libxlsxwriter/build/bug8+0xdb29e) (BuildId: e40ae509915daf6c86a9e328bddaa36cd11cb982) #1 0x562869e45ed8 in lxw_strdup /home/ubuntu/workspace/newest-libxlsxwriter/src/utility.c:471:12 #2 0x562869e4600f in lxw_strdup_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/utility.c:489:16 #3 0x562869d4a4b5 in _store_array_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8072:24 #4 0x562869d4adb5 in worksheet_write_dynamic_formula /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8146:12 #5 0x562869ce06a8 in main /home/ubuntu/workspace/newest-libxlsxwriter/build/../bugs/bug8.cpp:11:21 #6 0x7fca4046ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ubuntu/workspace/newest-libxlsxwriter/src/worksheet.c:8075:9 in _store_array_formula Shadow bytes around the buggy address: 0x0c047fff8040: fa fa 00 00 fa fa 00 00 fa fa 00 fa fa fa 07 fa 0x0c047fff8050: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00 0x0c047fff8060: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00 0x0c047fff8070: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00 0x0c047fff8080: fa fa 00 00 fa fa 00 00 fa fa 00 fa fa fa 00 fa =>0x0c047fff8090: fa fa 00 fa fa[fa]01 fa fa fa fa fa fa fa fa fa 0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2675438==ABORTING ```
gitea-mirror commented 2026-05-05 12:11:25 -06:00
Author
Owner
Copy link

@jmcnamara commented on GitHub (May 22, 2024):

Thanks. I'll take a look.

BTW, are you finding these via fuzz testing or some other method?

<!-- gh-comment-id:2123850150 --> @jmcnamara commented on GitHub (May 22, 2024): Thanks. I'll take a look. BTW, are you finding these via fuzz testing or some other method?
gitea-mirror commented 2026-05-05 12:11:28 -06:00
Author
Owner
Copy link

@ym-xie commented on GitHub (May 22, 2024):

Thanks. I'll take a look.

BTW, are you finding these via fuzz testing or some other method?

Yes, I wrote a new fuzz driver according to #431

<!-- gh-comment-id:2123923608 --> @ym-xie commented on GitHub (May 22, 2024): > Thanks. I'll take a look. > > BTW, are you finding these via fuzz testing or some other method? Yes, I wrote a new fuzz driver according to #431
gitea-mirror commented 2026-05-05 12:11:29 -06:00
Author
Owner
Copy link

@jmcnamara commented on GitHub (May 22, 2024):

Could you post some instructions on how to compile examples like above with AddressSanitizer.

<!-- gh-comment-id:2124006149 --> @jmcnamara commented on GitHub (May 22, 2024): Could you post some instructions on how to compile examples like above with AddressSanitizer.
gitea-mirror commented 2026-05-05 12:11:30 -06:00
Author
Owner
Copy link

@ym-xie commented on GitHub (May 22, 2024):

  1. Add set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fsanitize=address -fsanitize-coverage=trace-pc-guard") in CMakeList.txt
  2. build libxlsxwriter
  3. use clang++ -g -fsanitize=leak,address ../bugs/bug8.cpp -L. -lxlsxwriter -lz -o bug8 in build directory
<!-- gh-comment-id:2124032567 --> @ym-xie commented on GitHub (May 22, 2024): 1. Add `set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fsanitize=address -fsanitize-coverage=trace-pc-guard")` in CMakeList.txt 2. build libxlsxwriter 3. use `clang++ -g -fsanitize=leak,address ../bugs/bug8.cpp -L. -lxlsxwriter -lz -o bug8` in build directory
gitea-mirror commented 2026-05-05 12:11:33 -06:00
Author
Owner
Copy link

@jmcnamara commented on GitHub (May 24, 2024):

Fixed on main. Thanks.

<!-- gh-comment-id:2128691595 --> @jmcnamara commented on GitHub (May 24, 2024): Fixed on main. Thanks.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
coverity
cmake-improvements
cmake_pkgconfig_fix
ctest
button
tables
autofilter
dtoa
iwyu
openssl
gentoo
gh310
condition_format
rich_string_html
header_footer_images
custom_data_labels
object_position
gh265
constant_mode_comments2
constant_mode_comments
vml
md5
vcpkg
hyperlinks
api_refactor
win_fopen
gh203
rich_strings
chartsheet
in_mem_image
gh192
revert-162-master
data_validation
meson
charts
scan_build
utf8_strlen
tmpfileplus
custom_properties
insert_image
default_row
control_chars
worksheet_protect
dev
red_black
panes
mkstemp
defined_names
optimise
wip
v1.2.4
v1.2.3
v1.2.2
v1.2.1
v1.2.0
v1.1.9
v1.1.8
RELEASE_1.1.7
RELEASE_1.1.6
RELEASE_1.1.5
RELEASE_1.1.4
RELEASE_1.1.3
RELEASE_1.1.2
RELEASE_1.1.1
RELEASE_1.1.0
RELEASE_1.0.9
RELEASE_1.0.8
RELEASE_1.0.7
RELEASE_1.0.6
RELEASE_1.0.5
RELEASE_1.0.4
RELEASE_1.0.3
RELEASE_1.0.2
RELEASE_1.0.1
RELEASE_1.0.0
RELEASE_0.9.9
RELEASE_0.9.8
RELEASE_0.9.7
RELEASE_0.9.6
RELEASE_0.9.5
RELEASE_0.9.4
RELEASE_0.9.3
RELEASE_0.9.2
RELEASE_0.9.1
RELEASE_0.9.0
RELEASE_0.8.9
RELEASE_0.8.8
RELEASE_0.8.7
RELEASE_0.8.6
RELEASE_0.8.5
RELEASE_0.8.4
RELEASE_0.8.3
RELEASE_0.8.2
RELEASE_0.8.1
RELEASE_0.8.0
RELEASE_0.7.9
RELEASE_0.7.8
RELEASE_0.7.7
RELEASE_0.7.6
RELEASE_0.7.5
RELEASE_0.7.4
RELEASE_0.7.3
RELEASE_0.7.2
RELEASE_0.7.1
RELEASE_0.7.0
RELEASE_0.6.9
RELEASE_0.6.8
RELEASE_0.6.7
RELEASE_0.6.6
RELEASE_0.6.5
RELEASE_0.6.4
RELEASE_0.6.3
RELEASE_0.6.2
RELEASE_0.6.1
RELEASE_0.6.0
RELEASE_0.5.9
RELEASE_0.5.8
RELEASE_0.5.7
RELEASE_0.5.6
RELEASE_0.5.5
RELEASE_0.5.4
RELEASE_0.5.3
RELEASE_0.5.2
RELEASE_0.5.1
RELEASE_0.5.0
RELEASE_0.4.9
RELEASE_0.4.8
RELEASE_0.4.7
RELEASE_0.4.6
RELEASE_0.4.5
RELEASE_0.4.4
RELEASE_0.4.3
RELEASE_0.4.2
RELEASE_0.4.1
RELEASE_0.4.0
RELEASE_0.3.9
RELEASE_0.3.8
RELEASE_0.3.7
RELEASE_0.3.6
RELEASE_0.3.5
RELEASE_0.3.4
RELEASE_0.3.3
RELEASE_0.3.2
RELEASE_0.3.1
RELEASE_0.3.0
RELEASE_0.2.9
RELEASE_0.2.8
RELEASE_0.2.7
RELEASE_0.2.6
RELEASE_0.2.5
RELEASE_0.2.4
RELEASE_0.2.3
RELEASE_0.2.2
RELEASE_0.2.1
RELEASE_0.2.0
RELEASE_0.1.9
RELEASE_0.1.8
RELEASE_0.1.7
RELEASE_0.1.6
RELEASE_0.1.5
RELEASE_0.1.4
RELEASE_0.1.3
RELEASE_0.1.2
RELEASE_0.1.1
RELEASE_0.1.0
RELEASE_0.0.9
RELEASE_0.0.8
RELEASE_0.0.7
RELEASE_0.0.6
RELEASE_0.0.5
RELEASE_0.0.4
RELEASE_0.0.3
RELEASE_0.0.2
RELEASE_0.0.1
Labels
Clear labels   
awaiting user feedback

   
bug

   
cmake

   
cmake

   
docs

   
feature request

   
in progress

   
long term

   
medium term

   
medium term

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question

   
ready to close

   
short term

   
under investigation

   
wontfix
No labels
awaiting user feedback
bug
cmake
cmake
docs
feature request
in progress
long term
medium term
medium term
pull-request
question
question
ready to close
short term
under investigation
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/libxlsxwriter#349
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?