lewdlime / abcm2ps

abcm2ps is a command line program which converts ABC to music sheet in PostScript or SVG format. It is an extension of abc2ps which may handle many voices per staff. abcm2ps is Copyright © 2014-2016 Jean-Francois Moine.
http://moinejf.free.fr/
GNU General Public License v3.0
82 stars 31 forks source link

Division-by-zero vulnerability in parse.c:6056 #31

Closed invictus1306 closed 6 years ago

invictus1306 commented 6 years ago

Hi,

I'm hitting this bug in the latest version of abcm2ps (abcm2ps-8.13.21 (2018-05-05))

valgrind ./abcm2ps report4.abc 
==17600== Memcheck, a memory error detector
==17600== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==17600== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==17600== Command: ./abcm2ps report4.abc
==17600== 
abcm2ps-8.13.21 (2018-05-05)
File report4.abc
report4.abc:92:0: error: Bad voice ID in %%staves
report4.abc:92:0: error: Voice '144' of %%staves has no symbol
report4.abc:98:34: error: Decoration !-300349! not defined
report4.abc:107:63: error: Bad character
 107 (3CDE(3FGA B/c/d/e/d/c/B/A/ (18506zDE(256FGz z/c/d/e/d/c/B/z/|(0CDz(3zGA ...
                                                                    ^
==17600== 
==17600== Process terminating with default action of signal 8 (SIGFPE)
==17600==  Integer divide by zero at address 0x803061278
==17600==    at 0x434924: set_tuplet (parse.c:6056)
==17600==    by 0x434924: do_tune (parse.c:3608)
==17600==    by 0x4088A1: abc_parse (abcparse.c:177)
==17600==    by 0x41F686: txt_add_eos (front.c:379)
==17600==    by 0x4200E7: frontend (front.c:891)
==17600==    by 0x403FAC: treat_file (abcm2ps.c:239)
==17600==    by 0x4030E7: main (abcm2ps.c:1040)
==17600== 
==17600== HEAP SUMMARY:
==17600==     in use at exit: 636,821 bytes in 115 blocks
==17600==   total heap usage: 146 allocs, 31 frees, 1,768,065 bytes allocated
==17600== 
==17600== LEAK SUMMARY:
==17600==    definitely lost: 30 bytes in 3 blocks
==17600==    indirectly lost: 0 bytes in 0 blocks
==17600==      possibly lost: 0 bytes in 0 blocks
==17600==    still reachable: 636,791 bytes in 112 blocks
==17600==         suppressed: 0 bytes in 0 blocks
==17600== Rerun with --leak-check=full to see details of leaked memory
==17600== 
==17600== For counts of detected and suppressed errors, rerun with: -v
==17600== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

It is a division-by-zero vulnerability

<do_tune+2256>   idiv   r11d
$r11   : 0x0000000000000000

report4.zip