Arithmetic exception due to bad denom

Bug #1443443 reported by Chua Zheng Leong
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
TiMidity++
In Progress
Undecided
Unassigned
timidity (Debian)
Fix Released
Unknown
timidity (Ubuntu)
Fix Released
Undecided
Unassigned
Nominated for Bionic by Daniel van Vugt
Nominated for Cosmic by Daniel van Vugt
Nominated for Trusty by Daniel van Vugt
Nominated for Xenial by Daniel van Vugt

Bug Description

Was doing probabilistic fuzzing on TiMidity++ and got a divide trap.

1.
Description: Ubuntu 14.04.1 LTS
Release: 14.04

2.
timidity:
  Installed: 2.13.2-40.2
  Candidate: 2.13.2-40.2
  Version table:
 *** 2.13.2-40.2 0
        500 http://sg.archive.ubuntu.com/ubuntu/ trusty/universe amd64 Packages
        100 /var/lib/dpkg/status

3.
Graceful exit.

4.
SIGFPE (-8)

I've recompiled TiMidity++ for the symbols...

(gdb) r ../crash_midi_archive/crash1 -Ow -o /dev/null
Starting program: /usr/local/bin/timidity ../crash_midi_archive/crash1 -Ow -o /dev/null
Playing ../crash_midi_archive/crash1
MIDI file: ../crash_midi_archive/crash1
Format: 1 Tracks: 2 Divisions: 5872

Program received signal SIGFPE, Arithmetic exception.
0x00000000005bdfe2 in read_midi_file () at readmidi.c:4594
4594 at += current_file_info->divisions * 4 / denom;
(gdb) bt
#0 0x00000000005bdfe2 in read_midi_file () at readmidi.c:4594
#1 0x000000000056a88d in play_midi_file ()
#2 0x000000000056ea51 in dumb_pass_playing_list ()
#3 0x000000000040c7b6 in main () at timidity.c:5655

CVE References

Revision history for this message
Chua Zheng Leong (melynx) wrote :
description: updated
description: updated
Changed in timidity:
status: New → In Progress
Changed in timidity (Debian):
status: Unknown → Fix Released
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

Looks like the Debian fix was released in cosmic.

Changed in timidity (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.