null pointer dereference in proc_sym()
ATasm is a 6502 command-line cross-assembler.
Brought to you by:
schmelze
Hi,
In ATasm 1.09, I found null pointer dereference in function proc_sym
when deal with digit number ,in some condition the following bug will occurred,
line 1611, if get_nxt_word() return NULL,(if the line look like hex:"11 10 00 00" , but not always crash, I didn't analyse deeply).
The str[0] then will result in null pointer dereference.
── source:asm.c+1612 ──── 1607 if (!addr) 1608 skip_if(); 1609 break; 1610 case DOT_INCLUDE: /* .INCLUDE */ 1611 str=get_nxt_word(PARSE_NEXT_LINE); // str=0x00007fffffffd318 → 0x0000000000000000 → 1612 if (str[0]=='"') { 1613 str++; 1614 str[strlen(str)-1]=0; 1615 } 1616 open_file(str); 1617 break; ── threads ──── [#0] Id 1, Name: "atasm", stopped 0x55555555a4ee in proc_sym (), reason: SIGSEGV ─ trace ──── [#0] 0x55555555a4ee → proc_sym(sym=0x555555581a80) [#1] 0x55555555b5fe → do_cmd(buf=0x55555556c500 <buf> "") [#2] 0x55555555b715 → assemble(fname=0x7fffffffd600 "demo") [#3] 0x55555555cc56 → main(argc=0x2, argv=0x7fffffffdc08) ───
==3503060==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5563db8aa850 bp 0x7ffeda8ad000 sp 0x7ffeda8acfe0 T0) ==3503060==The signal is caused by a READ memory access. ==3503060==Hint: address points to the zero page. #0 0x5563db8aa84f in proc_sym /home//atasm/sasm.c:1612 #1 0x5563db8aef4a in do_cmd /home//atasm/sasm.c:1995 #2 0x5563db8af424 in assemble /home//atasm/sasm.c:2034 #3 0x5563db88d341 in main /home//atasm/sasm.c:2446 #4 0x7f5070ea80b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) #5 0x5563db88eddd in _start (/home//atasm/satasm+0xdddd) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /atasm/src/asm.c:1612 in proc_sym ==3503060==ABORTING