lewdlime / abcm2ps

abcm2ps is a command line program which converts ABC to music sheet in PostScript or SVG format. It is an extension of abc2ps which may handle many voices per staff. abcm2ps is Copyright © 2014-2016 Jean-Francois Moine.
http://moinejf.free.fr/
GNU General Public License v3.0
80 stars 31 forks source link

Crash in draw.c draw_gracenotes() #89

Open Microsvuln opened 3 years ago

Microsvuln commented 3 years ago

There is a crash in draw.c file in function draw_gracenotes()when the program reads a malformed input .

Output :

id:000983,sig:11,src:013870+014464,time:3776617,op:splice,rep:8:3:19: error: Invalid note duration
id:000983,sig:11,src:013870+014464,time:3776617,op:splice,rep:8:3:19: error: Note too short
AddressSanitizer:DEADLYSIGNAL
=================================================================
==29278==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc 0x0000004e8877 bp 0x7ffd9c5954f0 sp 0x7ffd9c594e60 T0)
==29278==The signal is caused by a READ memory access.
==29278==Hint: address points to the zero page.
    #0 0x4e8877 in draw_gracenotes /home/arash/abcm2ps/draw.c:1449:12
    #1 0x4e8877 in draw_symbols /home/arash/abcm2ps/draw.c:4832:4
    #2 0x4e8877 in draw_all_symb /home/arash/abcm2ps/draw.c:4866:4
    #3 0x5b7607 in output_music /home/arash/abcm2ps/music.c:5119:3
    #4 0x6b7a79 in generate /home/arash/abcm2ps/parse.c:1042:2
    #5 0x645f70 in gen_ly /home/arash/abcm2ps/parse.c:1063:2
    #6 0x645f70 in do_tune /home/arash/abcm2ps/parse.c:3643:2
    #7 0x54a1da in abc_eof /home/arash/abcm2ps/abcparse.c:202:2
    #8 0x54a1da in frontend /home/arash/abcm2ps/front.c:905:2
    #9 0x33549c in treat_file /home/arash/abcm2ps/abcm2ps.c:240:2
    #10 0x339393 in main /home/arash/abcm2ps/abcm2ps.c:1041:3
    #11 0x7f965a2e0bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
    #12 0x2868d9 in _start (/home/arash/abcm2ps/abcm2ps+0x2868d9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/arash/abcm2ps/draw.c:1449:12 in draw_gracenotes
==29278==ABORTING

Poc attached .

poc3.zip