A divide-by-zero error was discovered in graph3d.c. The vulnerability causes a Arithmetic exception and application crash.
1. install the latest gnuplot
2. run the command gnuplot < poc1
, where poc1 is the attached file
3. backtrace
Program received signal SIGFPE, Arithmetic exception. 0x000055555559b622 in boundary3d (count=1, plots=0x5555556bba80) at graph3d.c:419 419 i = (int) (plot_bounds.ytop - plot_bounds.ybot) / t->v_char - 1 - ktitle_lines;
#0 0x000055555559b622 in boundary3d (count=1, plots=0x5555556bba80) at graph3d.c:419 #1 do_3dplot (plots=0x5555556bba80, pcount=pcount@entry=1, replot_mode=replot_mode@entry=NORMAL_REPLOT) at graph3d.c:755 #2 0x00005555555d119e in eval_3dplots () at plot3d.c:2754 #3 0x00005555555d2b8e in plot3drequest () at plot3d.c:399 #4 0x0000555555578b93 in splot_command () at command.c:2350 #5 0x000055555557a0cc in command () at command.c:698 #6 do_line () at command.c:468 #7 0x000055555557a331 in com_line () at command.c:375 #8 0x0000555555569a64 in main (argc_orig=argc_orig@entry=1, argv=<optimized out>, argv@entry=0x7fffffffe228) at plot.c:681 #9 0x00007ffff7c440b3 in __libc_start_main (main=0x555555569470 <main>, argc=1, argv=0x7fffffffe228, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe218) at ../csu/libc-start.c:308 #10 0x0000555555569d3e in _start ()
emf fontsize -> infinity
character size -> zero
boom
Add [another!] terminal-independent sanity check and call it in two places.
This seems to be a duplication of https://sourceforge.net/p/gnuplot/bugs/2358/ ?