From 2f49a0df0d213ee323f694e7bdee8b8a097dc698 Mon Sep 17 00:00:00 2001
From: Henry <cryptix@riseup.net>
Date: Thu, 30 Apr 2015 15:30:54 +0200
Subject: [PATCH] found two panics with go-fuzz from Dmitry Vyukov

go-fuzz-build github.com/cryptix/wav
go-fuzz -bin=./wav-fuzz -corpus=./corpus -workdir=~/wdir
---
 corpus/16_50samples.wav        | Bin 0 -> 144 bytes
 corpus/16bit.wav               | Bin 0 -> 46 bytes
 corpus/24_50samples.wav        | Bin 0 -> 194 bytes
 corpus/24bit.wav               | Bin 0 -> 47 bytes
 corpus/headers_zerosamples.wav | Bin 0 -> 262 bytes
 corpus/u8bit.wav               | Bin 0 -> 45 bytes
 errors.go                      |   3 +++
 fuzz.go                        |  28 ++++++++++++++++++++
 reader.go                      |  17 +++++++++---
 reader_test.go                 |  47 +++++++++++++++++++++++++++++++++
 10 files changed, 91 insertions(+), 4 deletions(-)
 create mode 100644 corpus/16_50samples.wav
 create mode 100644 corpus/16bit.wav
 create mode 100644 corpus/24_50samples.wav
 create mode 100644 corpus/24bit.wav
 create mode 100644 corpus/headers_zerosamples.wav
 create mode 100644 corpus/u8bit.wav
 create mode 100644 fuzz.go

diff --git a/corpus/16_50samples.wav b/corpus/16_50samples.wav
new file mode 100644
index 0000000000000000000000000000000000000000..09dc1fd37b16e723ac1df3615d74d48195484ecb
GIT binary patch
literal 144
zcmWIYbaU%qU|<M$40BD(Em05vvKfKUWeo#EM+74S6N3OlN@7W33Q(MZ!Iy0|&n+P~
zNjCYLDw$eK_1jE7T0F9GaA0wkbggrfb^qnY;^ywM%`wp~(5l%~!$42#lCq?%hL|D0
v8Am&#{BMV^f8Q6p-uwLh6M@GDkIWw#JpS|~?|Id$4{zsujQRTRhs7TNu(dPD

literal 0
HcmV?d00001

diff --git a/corpus/16bit.wav b/corpus/16bit.wav
new file mode 100644
index 0000000000000000000000000000000000000000..76d3db29f4622e148aee42ffcadea0dddb8f86fb
GIT binary patch
literal 46
xcmWIYbaPW<U|<M$40BD(Em05vvKfKUWeo#EM+74S6N3OlN@7VO6HuIi0RYF62YCPh

literal 0
HcmV?d00001

diff --git a/corpus/24_50samples.wav b/corpus/24_50samples.wav
new file mode 100644
index 0000000000000000000000000000000000000000..3ef91b47fdadc093368745bf43b9c09980d0cb72
GIT binary patch
literal 194
zcmV;z06qUwNk&Gx00012K~_a(ZFC?I000010096*tN;Ma1Ofm902lydVRT`Z00000
z004|l22h#|GTRaq1R3TBAHUcn{%0z0rZ0koG=cIs+~7QIKtR(1L(CdQlYB-@9!FsK
zM(71b2Sr3gw?WcjKFm!zSBN#TA}}N}D$dU%Sr{FDD;91m4-PyC8iD~LBKvYb_3ZlZ
w*KzB%yyr6R<R22_wk+ZaI^w=9<1F*!%5CQmdg`_A?NXlcU|IEX@c5=S{1q%r1ONa4

literal 0
HcmV?d00001

diff --git a/corpus/24bit.wav b/corpus/24bit.wav
new file mode 100644
index 0000000000000000000000000000000000000000..3e3e9dbb39e2cfbd1483870706586bd777f81305
GIT binary patch
literal 47
xcmWIYbaPW@U|<M$40BD(Em05vvKfKUWeo$v85Sl6W(Em{l*E!mW}r9_007SE2Xz1d

literal 0
HcmV?d00001

diff --git a/corpus/headers_zerosamples.wav b/corpus/headers_zerosamples.wav
new file mode 100644
index 0000000000000000000000000000000000000000..b48026f4d7be0f19471de7d93dba0e701a751550
GIT binary patch
literal 262
zcmY+7F%N<;5QPr|CK?BR0*kvy+^sEOBL!0%btOTK1Ct$`o%}KWM&ql&1n=_F_g(vX
zT4vdshz@L@o?9D*@E%&ch@MA}1{6{ucV>;bEVD|MOby}f>1Huu+VqI4Khnb8&1dlf
zFY{9SAQx+DTf@?|Numc%DH5NSFn4I;MZq|~Ok2aN65NH1<{MA|xz&aht3FCI@1xMX
UL${q*N&!cZt8adr#<0KdK8cGj_y7O^

literal 0
HcmV?d00001

diff --git a/corpus/u8bit.wav b/corpus/u8bit.wav
new file mode 100644
index 0000000000000000000000000000000000000000..27debc9466085b42112861492b0b0a01be23096e
GIT binary patch
literal 45
scmWIYbaPW>U|<M$40BD(Em05vvKfKUWeo!uGcs^6q$HLkG6KaL0Kl^c{Qv*}

literal 0
HcmV?d00001

diff --git a/errors.go b/errors.go
index 87f2a86..54e5c0e 100644
--- a/errors.go
+++ b/errors.go
@@ -10,6 +10,9 @@ var (
 	ErrNotRiff      = errors.New("Not a RIFF file")
 	ErrNotWave      = errors.New("Not a WAVE file")
 
+	ErrBrokenChunkFmt  = errors.New("could not decode chunkFmt")
+	ErrNoBitsPerSample = errors.New("could not decode chunkFmt")
+
 	ErrFormatNotSupported = errors.New("Format not supported - Only uncompressed PCM currently")
 )
 
diff --git a/fuzz.go b/fuzz.go
new file mode 100644
index 0000000..19d3415
--- /dev/null
+++ b/fuzz.go
@@ -0,0 +1,28 @@
+// +build gofuzz
+
+package wav
+
+import (
+	"bytes"
+	"io"
+)
+
+func Fuzz(data []byte) int {
+	rd, err := NewReader(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		if rd != nil {
+			panic("rd != nil on error")
+		}
+		return 0
+	}
+	for {
+		_, err = rd.ReadSample()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return 0
+		}
+	}
+	return 1
+}
diff --git a/reader.go b/reader.go
index 98cdbb3..667b226 100644
--- a/reader.go
+++ b/reader.go
@@ -130,12 +130,16 @@ readLoop:
 		}
 	}
 
-	// Is audio supported ?
-	if wav.chunkFmt.AudioFormat != 1 {
-		return ErrFormatNotSupported
+	if wav.chunkFmt == nil {
+		return ErrBrokenChunkFmt
 	}
 
 	wav.bytesPerSample = uint32(wav.chunkFmt.BitsPerSample / 8)
+
+	if wav.bytesPerSample == 0 {
+		return ErrNoBitsPerSample
+	}
+
 	wav.numSamples = wav.dataBlocSize / wav.bytesPerSample
 	wav.duration = time.Duration(float64(wav.numSamples)/float64(wav.chunkFmt.SampleRate)) * time.Second
 
@@ -144,7 +148,7 @@ readLoop:
 
 // parseChunkFmt
 func (wav *Reader) parseChunkFmt() (err error) {
-	wav.chunkFmt = &riffChunkFmt{}
+	wav.chunkFmt = new(riffChunkFmt)
 
 	if err = binary.Read(wav.input, binary.LittleEndian, wav.chunkFmt); err != nil {
 		return err
@@ -162,6 +166,11 @@ func (wav *Reader) parseChunkFmt() (err error) {
 		}
 	}
 
+	// Is audio supported ?
+	if wav.chunkFmt.AudioFormat != 1 {
+		return ErrFormatNotSupported
+	}
+
 	return nil
 }
 
diff --git a/reader_test.go b/reader_test.go
index ad15142..7af3ac2 100644
--- a/reader_test.go
+++ b/reader_test.go
@@ -3,6 +3,7 @@ package wav
 import (
 	"bytes"
 	"io"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -194,3 +195,49 @@ func TestReadSample(t *testing.T) {
 	assert.Nil(t, err)
 	assert.Equal(t, 257, sample)
 }
+
+// panic: runtime error: invalid memory address or nil pointer dereference
+// [signal 0xb code=0x1 addr=0x4 pc=0x4399fb]
+//
+// goroutine 1 [running]:
+// github.com/cryptix/wav.(*Reader).parseHeaders(0xc208033720, 0x0, 0x0)
+// 	/tmp/go-fuzz-build857960013/src/github.com/cryptix/wav/reader.go:191 +0xe3b
+// github.com/cryptix/wav.NewReader(0x7f23a9550bd8, 0xc208037c80, 0x2d, 0xc208033720, 0x0, 0x0)
+// 	/tmp/go-fuzz-build857960013/src/github.com/cryptix/wav/reader.go:64 +0x177
+// github.com/cryptix/wav.Fuzz(0x7f23a92cf000, 0x2d, 0x100000, 0x2)
+// 	/tmp/go-fuzz-build857960013/src/github.com/cryptix/wav/fuzz.go:12 +0x167
+// github.com/dvyukov/go-fuzz/go-fuzz-dep.Main(0x570c60, 0x5d4200, 0x5f6, 0x5f6)
+// 	/home/cryptix/go/src/github.com/dvyukov/go-fuzz/go-fuzz-dep/main.go:64 +0x309
+// main.main()
+// 	/tmp/go-fuzz-build857960013/src/go-fuzz-main/main.go:10 +0x4e
+// exit status 2
+func TestReadFuzzed_panic1(t *testing.T) {
+	t.Parallel()
+	wavFile := strings.NewReader("RIFF%\x00\x00\x00WAVE0000\x10\x00\x00\x000000000000000000data00000")
+	_, err := NewReader(wavFile, int64(wavFile.Len()))
+	assert.NotNil(t, err)
+	assert.Equal(t, ErrBrokenChunkFmt, err)
+}
+
+// panic: runtime error: integer divide by zero
+// [signal 0x8 code=0x1 addr=0x439ae9 pc=0x439ae9]
+//
+// goroutine 1 [running]:
+// github.com/cryptix/wav.(*Reader).parseHeaders(0xc208032cd0, 0x0, 0x0)
+// 	/tmp/go-fuzz-build857960013/src/github.com/cryptix/wav/reader.go:200 +0xf29
+// github.com/cryptix/wav.NewReader(0x7fbca32b6bd8, 0xc208037ef0, 0x2d, 0xc208032cd0, 0x0, 0x0)
+// 	/tmp/go-fuzz-build857960013/src/github.com/cryptix/wav/reader.go:64 +0x177
+// github.com/cryptix/wav.Fuzz(0x7fbca3035000, 0x2d, 0x100000, 0x2)
+// 	/tmp/go-fuzz-build857960013/src/github.com/cryptix/wav/fuzz.go:12 +0x167
+// github.com/dvyukov/go-fuzz/go-fuzz-dep.Main(0x570c60, 0x5d4200, 0x5f6, 0x5f6)
+// 	/home/cryptix/go/src/github.com/dvyukov/go-fuzz/go-fuzz-dep/main.go:64 +0x309
+// main.main()
+// 	/tmp/go-fuzz-build857960013/src/go-fuzz-main/main.go:10 +0x4e
+// exit status 2
+func TestReadFuzzed_panic2(t *testing.T) {
+	t.Parallel()
+	wavFile := strings.NewReader("RIFF%\x00\x00\x00WAVEfmt \x10\x00\x00\x00\x01\x00000000000000\a\x00data00000")
+	_, err := NewReader(wavFile, int64(wavFile.Len()))
+	assert.NotNil(t, err)
+	assert.Equal(t, ErrBrokenChunkFmt, err)
+}