null pointer dereference in proc_sym()
ATasm is a 6502 command-line cross-assembler.
Brought to you by:
schmelze
Hi,
In ATasm 1.09, I found null pointer dereference in function proc_sym
when deal with digit number ,in some condition the following bug will occurred,
line 1611, if get_nxt_word() return NULL,(if the line look like hex:"11 10 00 00" , but not always crash, I didn't analyse deeply).
The str[0] then will result in null pointer dereference.
── source:asm.c+1612 ────
1607 if (!addr)
1608 skip_if();
1609 break;
1610 case DOT_INCLUDE: /* .INCLUDE */
1611 str=get_nxt_word(PARSE_NEXT_LINE);
// str=0x00007fffffffd318 → 0x0000000000000000
→ 1612 if (str[0]=='"') {
1613 str++;
1614 str[strlen(str)-1]=0;
1615 }
1616 open_file(str);
1617 break;
── threads ────
[#0] Id 1, Name: "atasm", stopped 0x55555555a4ee in proc_sym (), reason: SIGSEGV
─ trace ────
[#0] 0x55555555a4ee → proc_sym(sym=0x555555581a80)
[#1] 0x55555555b5fe → do_cmd(buf=0x55555556c500 <buf> "")
[#2] 0x55555555b715 → assemble(fname=0x7fffffffd600 "demo")
[#3] 0x55555555cc56 → main(argc=0x2, argv=0x7fffffffdc08)
───
==3503060==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5563db8aa850 bp 0x7ffeda8ad000 sp 0x7ffeda8acfe0 T0)
==3503060==The signal is caused by a READ memory access.
==3503060==Hint: address points to the zero page.
#0 0x5563db8aa84f in proc_sym /home//atasm/sasm.c:1612
#1 0x5563db8aef4a in do_cmd /home//atasm/sasm.c:1995
#2 0x5563db8af424 in assemble /home//atasm/sasm.c:2034
#3 0x5563db88d341 in main /home//atasm/sasm.c:2446
#4 0x7f5070ea80b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#5 0x5563db88eddd in _start (/home//atasm/satasm+0xdddd)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /atasm/src/asm.c:1612 in proc_sym
==3503060==ABORTING