Package: birthday Version: 1.6.2-4 Severity: normal Dear Patrick Uiterwijk,
Some malformed input files result in a hung process with no warnings for longer than 1 second. This is reproducible in both jessie and sid.
I have attached some example inputs that reproduce the bug. Manual backtraces using gdb point to lines 386 and 387 of bdengine.c in the ddiff() function and lines 413 and 414 of bdengine.c in the delta() function.
The inputs were generated by afl-fuzz. Sincerely, Nathaniel Beaver -- System Information: Debian Release: 8.5 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages birthday depends on: ii libc6 2.19-18+deb8u4 Versions of packages birthday recommends: ii perl 5.20.2-3+deb8u5 birthday suggests no packages. -- no debconf information
birthday-hang.tar.gz
Description: application/gzip
