René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[IT] [XM] OOB reads in envelope code","articleBody":"From a fuzz archive from Aug.2019: Files attached with valgrind outputs.\r\nValgrind runs were made on an i686-linux using examples/test/test.c.  An\r\nexample output is inlined below from the 1st file, the rest of them are\r\nsimilar. @AliceLR: Need help with these.\r\n\r\n```\r\nPlaying  (1 chn)\r\n==29020== Invalid read of size 2\r\n==29020==    at 0x804C888: ProcessEnvelope (mplayer.c:440)\r\n==29020==    by 0x8051805: pt_UpdateVoices (mplayer.c:2831)\r\n==29020==    by 0x805339A: Player_HandleTick (mplayer.c:3410)\r\n==29020==    by 0x8077F3E: VC1_WriteSamples (virtch.c:1161)\r\n==29020==    by 0x80776D8: VC1_WriteBytes (virtch_common.c:278)\r\n==29020==    by 0x8055F8E: VC_WriteBytes (virtch_common.c:161)\r\n==29020==    by 0x8048D87: NS_Update (drv_nos.c:70)\r\n==29020==    by 0x804966D: MikMod_Update (mdriver.c:311)\r\n==29020==    by 0x8048CB6: main (test.c:84)\r\n==29020==  Address 0x404aea0 is 12 bytes after a block of size 4 alloc'd\r\n==29020==    at 0x4006041: calloc (vg_replace_malloc.c:593)\r\n==29020==    by 0x8048E18: MikMod_calloc (mmalloc.c:118)\r\n==29020==    by 0x804B006: AllocTracks (mloader.c:219)\r\n==29020==    by 0x806188D: IT_Load (load_it.c:1008)\r\n==29020==    by 0x804BB73: Player_LoadGeneric_internal (mloader.c:570)\r\n==29020==    by 0x804BE8D: Player_LoadGeneric (mloader.c:647)\r\n==29020==    by 0x804BF54: Player_LoadFP (mloader.c:675)\r\n==29020==    by 0x804BFA9: Player_Load (mloader.c:689)\r\n==29020==    by 0x8048C64: main (test.c:74)\r\n==29020== \r\n==29020== Invalid read of size 2\r\n==29020==    at 0x804C89E: ProcessEnvelope (mplayer.c:441)\r\n==29020==    by 0x8051805: pt_UpdateVoices (mplayer.c:2831)\r\n==29020==    by 0x805339A: Player_HandleTick (mplayer.c:3410)\r\n==29020==    by 0x8077F3E: VC1_WriteSamples (virtch.c:1161)\r\n==29020==    by 0x80776D8: VC1_WriteBytes (virtch_common.c:278)\r\n==29020==    by 0x8055F8E: VC_WriteBytes (virtch_common.c:161)\r\n==29020==    by 0x8048D87: NS_Update (drv_nos.c:70)\r\n==29020==    by 0x804966D: MikMod_Update (mdriver.c:311)\r\n==29020==    by 0x8048CB6: main (test.c:84)\r\n==29020==  Address 0x404aea2 is 14 bytes after a block of size 4 alloc'd\r\n==29020==    at 0x4006041: calloc (vg_replace_malloc.c:593)\r\n==29020==    by 0x8048E18: MikMod_calloc (mmalloc.c:118)\r\n==29020==    by 0x804B006: AllocTracks (mloader.c:219)\r\n==29020==    by 0x806188D: IT_Load (load_it.c:1008)\r\n==29020==    by 0x804BB73: Player_LoadGeneric_internal (mloader.c:570)\r\n==29020==    by 0x804BE8D: Player_LoadGeneric (mloader.c:647)\r\n==29020==    by 0x804BF54: Player_LoadFP (mloader.c:675)\r\n==29020==    by 0x804BFA9: Player_Load (mloader.c:689)\r\n==29020==    by 0x8048C64: main (test.c:74)\r\n```\r\n[101-it.tar.gz](https://github.com/sezero/mikmod/files/10421508/101-it.tar.gz)\r\n[103-xm.tar.gz](https://github.com/sezero/mikmod/files/10421509/103-xm.tar.gz)\r\n","author":{"url":"https://github.com/sezero","@type":"Person","name":"sezero"},"datePublished":"2023-01-15T23:22:11.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/70/mikmod/issues/70"}