lewdlime / abcm2ps

abcm2ps is a command line program which converts ABC to music sheet in PostScript or SVG format. It is an extension of abc2ps which may handle many voices per staff. abcm2ps is Copyright © 2014-2016 Jean-Francois Moine.
http://moinejf.free.fr/
GNU General Public License v3.0
80 stars 31 forks source link

Null pointer dereference in function calculate_beam() in draw.c #95

Closed chibataiki closed 3 years ago

chibataiki commented 3 years ago

Hi , Null pointer deference was found in calculate_beam() in draw.c

version : 9fa642d

env: ubuntu 20.04 x86_64 gcc version 9.3.0

reproduce: ./configure make ./abcm2ps poc

null_pointer_draw.c_calculate_beam_341.zip

Like the old issue #72 , seems not well fixed.

debug info

─ source:draw.c+341 ────
    336         b += ys;
    337     } else if (!(s1->flags & ABC_F_GRACE)) {    /* normal notes */
    338         float stem_err, beam_h;
    339
    340         beam_h = BEAM_DEPTH + BEAM_SHIFT * (nflags - 1);
           // s=0x00007fffffffe038  →  [...]  →  0x0000555555613ad8
 →  341         while (s->ts_prev->abc_type == ABC_T_NOTE
    342             && s->ts_prev->time == s->time
    343             && s->ts_prev->x > s1->xs)
    344             s = s->ts_prev;
    345
    346         for (; s && s->time <= s2->time; s = s->ts_next) {
─── trace ────
[#0] 0x5555555702e4 → calculate_beam(bm=0x7fffffffe090, s1=0x555555612aa8)
[#1] 0x55555557c5ed → draw_sym_near()
[#2] 0x55555559542a → delayed_output(indent=0)
[#3] 0x55555559562d → output_music()
[#4] 0x555555597aeb → generate()
[#5] 0x555555597c2e → gen_ly(eob=0x0)
[#6] 0x55555559eca1 → do_tune()
[#7] 0x55555555e4f1 → abc_eof()
[#8] 0x555555585f83 → frontend(s=0x55555561d109 "", ftype=0x0, fname=0x5555555fab00 "poc")
[#9] 0x55555555c4ba → treat_file(fn=0x7fffffffe6f3 "poc")
[#10] 0x000055555555c5ae in treat_abc_file
[#11] 0x000055555555dc03 in main

gef➤  p s
$1 = (struct SYMBOL *) 0x5555555fbaa8
gef➤  p s->ts_prev
$2 = (struct SYMBOL *) 0x0
chibataiki commented 3 years ago

Thanks, tried and fixed.