Division by zero at sox/src/adpcm.c:343

[hkctkuy]

🐛 Describe the bug

Hi, I've been fuzzing torchaudio project with sydr-fuzz and found crash at sox/src/adpcm.c:343.

I think, division by zero occurs because ft->signal.channels in sox/src/wav.c:584 it reads 0 to wChannels from ft and it sets to ft->signal.channels in sox/src/wav.c:711, after which there is a division by this in the crashline.

How to reproduce

1. Build docker from here and run the container:

sudo docker build -t oss-sydr-fuzz-torchaudio .
sudo docker run --privileged --rm -v `pwd`:/fuzz -it oss-sydr-fuzz-torchaudio /bin/bash

2. Run the target on this input: crash-0c7c5e2a18636697f83844619356032421619416

UBSAN_OPTIONS=print_stacktrace=1,report_error_type=1 /load_audio_afl crash-0c7c5e2a18636697f83844619356032421619416

3. You will see the following output:

/audio/build/third_party/sox/src/sox/src/adpcm.c:343:26: runtime error: division by zero
    #0 0x19335fb7 in lsx_ms_adpcm_samples_in /audio/build/third_party/sox/src/sox/src/adpcm.c:343:26
    #1 0x19174f91 in startread /audio/build/third_party/sox/src/sox/src/wav.c:924:13
    #2 0x18e96c57 in open_read /audio/build/third_party/sox/src/sox/src/formats.c:545:32
    #3 0x9374d6 in torchaudio::sox::apply_effects_file(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::allocator<std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > const&, c10::optional<bool>, c10::optional<bool>, c10::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > const&) /audio/torchaudio/csrc/sox/effects.cpp:94:16
    #4 0x8f8b33 in torchaudio::sox::load_audio_file(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, c10::optional<long> const&, c10::optional<long> const&, c10::optional<bool>, c10::optional<bool>, c10::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > const&) /audio/torchaudio/csrc/sox/io.cpp:69:10
    #5 0x8f440b in LLVMFuzzerTestOneInput /audio/load_audio.cc:35:9
    #6 0x18e92e7d in ExecuteFilesOnyByOne /AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7
    #7 0x18e92c88 in LLVMFuzzerRunDriver /AFLplusplus/utils/aflpp_driver/aflpp_driver.c
    #8 0x18e92848 in main /AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10
    #9 0x7f0e32488082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee)
    #10 0x833cbd in _start (/load_audio_afl+0x833cbd)

SUMMARY: UndefinedBehaviorSanitizer: integer-divide-by-zero /audio/build/third_party/sox/src/sox/src/adpcm.c:343:26 in 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==180==ERROR: AddressSanitizer: FPE on unknown address 0x000019335fd2 (pc 0x000019335fd2 bp 0x000000000000 sp 0x7ffecd825400 T0)
    #0 0x19335fd2 in lsx_ms_adpcm_samples_in /audio/build/third_party/sox/src/sox/src/adpcm.c:343:26
    #1 0x19174f91 in startread /audio/build/third_party/sox/src/sox/src/wav.c:924:13
    #2 0x18e96c57 in open_read /audio/build/third_party/sox/src/sox/src/formats.c:545:32
    #3 0x9374d6 in torchaudio::sox::apply_effects_file(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::allocator<std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > const&, c10::optional<bool>, c10::optional<bool>, c10::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > const&) /audio/torchaudio/csrc/sox/effects.cpp:94:16
    #4 0x8f8b33 in torchaudio::sox::load_audio_file(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, c10::optional<long> const&, c10::optional<long> const&, c10::optional<bool>, c10::optional<bool>, c10::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > const&) /audio/torchaudio/csrc/sox/io.cpp:69:10
    #5 0x8f440b in LLVMFuzzerTestOneInput /audio/load_audio.cc:35:9
    #6 0x18e92e7d in ExecuteFilesOnyByOne /AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7
    #7 0x18e92c88 in LLVMFuzzerRunDriver /AFLplusplus/utils/aflpp_driver/aflpp_driver.c
    #8 0x18e92848 in main /AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10
    #9 0x7f0e32488082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee)
    #10 0x833cbd in _start (/load_audio_afl+0x833cbd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /audio/build/third_party/sox/src/sox/src/adpcm.c:343:26 in lsx_ms_adpcm_samples_in
==180==ABORTING

Versions

torchaudio version: 30afaa9
pytorch version: 0f1621df1a0a73956c7ce4e2f72f069e610e0137
sox version: 14.4.2
OS: Ubuntu 20.04

[mthrok]

#3497 has landed, and now torchaudio links to sox dynamically. We no longer compile the specified code by ourselves and therefore this issue is now irrelevant.

Feel free to fuzz the code under torchaudio/csrc, and report issues there. Thanks,