Uninitialized use in speexenc

[BowenWang]

This bug is found in git commit 6e04bfa.

to reproduce the bug:
valgrind ./speexenc test.input -

PoC input is attached.(this input is generated by fuzzer, the pdf suffix is to bypass github's upload regulation)
poc.pdf

[tmatth]

This bug is found in git commit 6e04bfa.

to reproduce the bug:
valgrind ./speexenc test.input -

PoC input is attached.(this input is generated by fuzzer, the pdf suffix is to bypass github's upload regulation)
poc.pdf

Can't reproduce here, can you paste the output you're seeing with valgrind --track-origins=yes ?

[BowenWang]

==14355== Memcheck, a memory error detector
==14355== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==14355== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==14355== Command: ./speexenc /home/bwang/Bowen/gitrepo/buddy-test-results/speexenc/monitor_out/input.17102 -
==14355== Parent PID: 10957
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484EC51: lpc_to_lsp (lsp.c:335)
==14355== by 0x4855C37: nb_encode (nb_celp.c:480)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484ECE5: lpc_to_lsp (lsp.c:352)
==14355== by 0x4855C37: nb_encode (nb_celp.c:480)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484EDA8: lpc_to_lsp (lsp.c:0)
==14355== by 0x4855C37: nb_encode (nb_celp.c:480)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484EDAD: lpc_to_lsp (lsp.c:0)
==14355== by 0x4855C37: nb_encode (nb_celp.c:480)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484BCE4: compute_rms (filters.c:315)
==14355== by 0x484BCE4: compute_rms16 (filters.c:319)
==14355== by 0x4855F87: nb_encode (nb_celp.c:561)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4CA1108: log (w_log_compat.c:31)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12BC8: __ieee754_log_fma (e_log.c:72)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12BD6: __ieee754_log_fma (e_log.c:82)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12C00: __ieee754_log_fma (e_log.c:88)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12C42: __ieee754_log_fma (e_log.c:123)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12C7A: __ieee754_log_fma (e_log.c:136)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12CD4: __ieee754_log_fma (e_log.c:142)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12CF4: __ieee754_log_fma (e_log.c:151)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12D1D: __ieee754_log_fma (e_log.c:152)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12D5D: __ieee754_log_fma (e_log.c:155)
==14355== by 0x48568D3: nb_encode (nb_celp.c:775)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D12280: __ieee754_exp_fma (e_exp.c:68)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4D122B5: __ieee754_exp_fma (e_exp.c:103)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D12598: __ieee754_exp_fma (e_exp.c:124)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D125AA: __ieee754_exp_fma (e_exp.c:125)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D125B8: __ieee754_exp_fma (e_exp.c:124)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4D125BE: __ieee754_exp_fma (e_exp.c:125)
==14355== by 0x4CA188E: exp (w_exp_compat.c:29)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4CA18B1: exp (w_exp_compat.c:30)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4CA18BB: exp (w_exp_compat.c:30)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4CA18C8: exp (w_exp_compat.c:30)
==14355== by 0x4856912: nb_encode (nb_celp.c:780)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4854224: scal_quant (vq.c:54)
==14355== by 0x485767D: nb_encode (nb_celp.c:966)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4853E8E: vq_nbest (vq_sse.h:59)
==14355== by 0x4848C27: split_cb_search_shape_sign (cb_search.c:389)
==14355== by 0x485777C: nb_encode (nb_celp.c:987)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4853E52: vq_nbest (vq_sse.h:57)
==14355== by 0x4848C27: split_cb_search_shape_sign (cb_search.c:389)
==14355== by 0x485777C: nb_encode (nb_celp.c:987)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4848C86: split_cb_search_shape_sign (cb_search.c:398)
==14355== by 0x485777C: nb_encode (nb_celp.c:987)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4848CA9: split_cb_search_shape_sign (cb_search.c:402)
==14355== by 0x485777C: nb_encode (nb_celp.c:987)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484FC24: open_loop_nbest_pitch (ltp.c:266)
==14355== by 0x484FEE3: pitch_search_3tap (ltp.c:614)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484FC67: open_loop_nbest_pitch (ltp.c:275)
==14355== by 0x484FEE3: pitch_search_3tap (ltp.c:614)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4850EC4: pitch_gain_search_3tap_vq (ltp.c:338)
==14355== by 0x4850EC4: pitch_gain_search_3tap (ltp.c:489)
==14355== by 0x484FFD1: pitch_search_3tap (ltp.c:626)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4850EEA: pitch_gain_search_3tap (ltp.c:497)
==14355== by 0x484FFD1: pitch_search_3tap (ltp.c:626)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x4850F2B: pitch_gain_search_3tap (ltp.c:498)
==14355== by 0x484FFD1: pitch_search_3tap (ltp.c:626)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484FFE5: pitch_search_3tap (ltp.c:628)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484FFEA: pitch_search_3tap (ltp.c:628)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x48500B0: pitch_search_3tap (ltp.c:643)
==14355== by 0x485746A: nb_encode (nb_celp.c:932)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x484BCE4: compute_rms (filters.c:315)
==14355== by 0x484BCE4: compute_rms16 (filters.c:319)
==14355== by 0x4857638: nb_encode (nb_celp.c:946)
==14355== by 0x4852A5A: speex_encode_int (speex.c:149)
==14355== by 0x403AE0: main (speexenc.c:860)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x40279A: main (speexenc.c:276)
==14355==
==14355== Use of uninitialised value of size 8
==14355== at 0x489FFC1: ogg_page_checksum_set (in /usr/lib/x86_64-linux-gnu/libogg.so.0.8.2)
==14355== by 0x48A17A9: ogg_stream_pageout (in /usr/lib/x86_64-linux-gnu/libogg.so.0.8.2)
==14355== by 0x403C6F: main (speexenc.c:919)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x4848545: split_cb_search_shape_sign (cb_search.c:339)
==14355==
==14355== Conditional jump or move depends on uninitialised value(s)
==14355== at 0x4B329C7: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1226)
==14355== by 0x4B271D7: fwrite (iofwrite.c:39)
==14355== by 0x403CBE: oe_write_page (speexenc.c:77)
==14355== by 0x403CBE: main (speexenc.c:921)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x4848545: split_cb_search_shape_sign (cb_search.c:339)
==14355==
==14355== Syscall param write(buf) points to uninitialised byte(s)
==14355== at 0x4BB0FD4: write (write.c:26)
==14355== by 0x4B3233C: _IO_file_write@@GLIBC_2.2.5 (fileops.c:1188)
==14355== by 0x4B33A70: new_do_write (fileops.c:456)
==14355== by 0x4B33A70: _IO_do_write@@GLIBC_2.2.5 (fileops.c:433)
==14355== by 0x4B35B81: _IO_flush_all_lockp (genops.c:706)
==14355== by 0x4B35D84: _IO_cleanup (genops.c:858)
==14355== by 0x4AEB519: __run_exit_handlers (exit.c:130)
==14355== by 0x4AEB559: exit (exit.c:139)
==14355== by 0x4ACB0A1: (below main) (libc-start.c:342)
==14355== Address 0x4e29208 is 200 bytes inside a block of size 1,024 alloc'd
==14355== at 0x483774F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14355== by 0x4B25C9B: _IO_file_doallocate (filedoalloc.c:101)
==14355== by 0x4B34EC1: _IO_doallocbuf (genops.c:347)
==14355== by 0x4B33FC7: _IO_file_overflow@@GLIBC_2.2.5 (fileops.c:752)
==14355== by 0x4B32A14: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1251)
==14355== by 0x4B271D7: fwrite (iofwrite.c:39)
==14355== by 0x40379E: oe_write_page (speexenc.c:76)
==14355== by 0x40379E: main (speexenc.c:780)
==14355== Uninitialised value was created by a stack allocation
==14355== at 0x4848545: split_cb_search_shape_sign (cb_search.c:339)
==14355==
==14355==
==14355== HEAP SUMMARY:
==14355== in use at exit: 0 bytes in 0 blocks
==14355== total heap usage: 10 allocs, 10 frees, 39,616 bytes allocated
==14355==
==14355== All heap blocks were freed -- no leaks are possible
==14355==
==14355== For counts of detected and suppressed errors, rerun with: -v
==14355== ERROR SUMMARY: 6262 errors from 41 contexts (suppressed: 0 from 0)

[tmatth]

Ah ok I was able to reproduce on 5dceaaf with:

valgrind --track-origins=yes src/.libs/speexenc ~/Downloads/poc.wav - > bob.spx

The issue is that the input buffer in speexenc is not initialized, I will post fix on https://gitlab.xiph.org/xiph/speex

[tmatth]

Ah ok I was able to reproduce on 5dceaaf with:

valgrind --track-origins=yes src/.libs/speexenc ~/Downloads/poc.wav - > bob.spx

The issue is that the input buffer in speexenc is not initialized, I will post fix on https://gitlab.xiph.org/xiph/speex

https://gitlab.xiph.org/xiph/speex/-/merge_requests/7