lewdlime / abcm2ps

abcm2ps is a command line program which converts ABC to music sheet in PostScript or SVG format. It is an extension of abc2ps which may handle many voices per staff. abcm2ps is Copyright © 2014-2016 Jean-Francois Moine.
http://moinejf.free.fr/
GNU General Public License v3.0
84 stars 31 forks source link

Division-by-zero vulnerability in parse.c:6098 #30

Closed invictus1306 closed 6 years ago

invictus1306 commented 6 years ago

Hi,

I'm hitting this bug in the latest version of abcm2ps (abcm2ps-8.13.21 (2018-05-05))

valgrind ./report3.abc 
valgrind: report3.abc: command not found
root@invictus1306-VirtualBox:/home/invictus1306/Documents/todel/abcm2ps# valgrind ./abcm2ps report3.abc 
==17541== Memcheck, a memory error detector
==17541== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==17541== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==17541== Command: ./abcm2ps report3.abc
==17541== 
abcm2ps-8.13.21 (2018-05-05)
File report3.abc
==17541== 
==17541== Process terminating with default action of signal 8 (SIGFPE)
==17541==  Integer divide by zero at address 0x802F91060
==17541==    at 0x434A04: set_tuplet (parse.c:6098)
==17541==    by 0x434A04: do_tune (parse.c:3608)
==17541==    by 0x4088A1: abc_parse (abcparse.c:177)
==17541==    by 0x41F686: txt_add_eos (front.c:379)
==17541==    by 0x4200E7: frontend (front.c:891)
==17541==    by 0x403FAC: treat_file (abcm2ps.c:239)
==17541==    by 0x4030E7: main (abcm2ps.c:1040)
==17541== 
==17541== HEAP SUMMARY:
==17541==     in use at exit: 218,169 bytes in 29 blocks
==17541==   total heap usage: 44 allocs, 15 frees, 300,837 bytes allocated
==17541== 
==17541== LEAK SUMMARY:
==17541==    definitely lost: 0 bytes in 0 blocks
==17541==    indirectly lost: 0 bytes in 0 blocks
==17541==      possibly lost: 0 bytes in 0 blocks
==17541==    still reachable: 218,169 bytes in 29 blocks
==17541==         suppressed: 0 bytes in 0 blocks
==17541== Rerun with --leak-check=full to see details of leaked memory
==17541== 
==17541== For counts of detected and suppressed errors, rerun with: -v
==17541== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

It is a division-by-zero vulnerability report3.zip

<do_tune+2482>   idiv   esi
$rsi   : 0x0000000000000000