How long does it take to fix a crash-bug?

Friday, January 11. 2008

How long does it take to fix a crash-bug?

About one year ago, Sam Hocevar posted some results on tests with his fuzzing tool zzuf, which showed a large number of crashes in various applications, especially multimedia apps.
Crash bugs on invalid input very often lead to security issues, thus this should be taken seriously.

Now, I took the freedom to have a look how many of the issues found back then were fixed. I used the most current versions in gentoo linux (testing/~x86-system), which tend to be quite up-to-date. I also cross-checked the crashes for other apps, as they often use the same or similar code.
Seems only vlc devs did their homework (Sam Hocevar is part of the vlc team). Interesting enough, even firefox seems to have a gif-crasher since a year.

gstreamer crash by lol-ffplay.mpg lol-gstreamer.m2v lol-mplayer.m2v lol-mplayer.mpg lol-vlc.m2v lol-vlc.mpg
endless loop by lol-ffplay.m2v lol-xine.mpg

mplayer hang by lol-mplayer.wmv,
crash by lol-ffplay.flac lol-mplayer.aac lol-mplayer.mpg lol-mplayer.ogg lol-ogg123.flac lol-vlc.aac lol-xine.aac

xine crash by lol-mplayer.wmv lol-ffplay.m2v lol-ffplay.ogg lol-ffplay.wmv lol-gstreamer.avi lol-ogg123.flac lol-vlc.aac lol-xine.mpg

firefox crash by lol-firefox.gif

Posted by Hanno Böck in English, Linux, Security at 05:56 | Comments (3) | Trackbacks (0)

Defined tags for this entry: firefox, gstreamer, mplayer, multimedia, security, vlc, xine, zzuf

Related entries by tags:

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

which version did you test?

#1 lu_zero on 2008-01-12 05:41 (Reply)

Cite "I used the most current versions in gentoo linux (testing/~x86-system)" on the time of my writing.

mplayer 1.0_rc2_p24929-r2
xine-lib-1.1.9 (update to 1.1.9.1 is now available, but first tests don't show much changes)
gstreamer-0.10.15
firefox 2.0.0.11

#1.1 Hanno (Homepage) on 2008-01-12 11:38 (Reply)

Just tested those files, and the ones from the zuff page ... and nothing crashes here with latest cvs of all gstreamer + plugins.

If you get crashes, tell us on #gstreamer on irc.freenode.net or via the gstreamer bugzilla tracker (bugzilla.gnome.org Product:GStreamer)

#2 Edward Hervey on 2008-01-15 16:26 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications. To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above:
	Remember Information? Subscribe to this entry