Bug in div by 0 in q3 after find_quartile returns a q3=0

[bleuge]

Hi,
I've ported tlsh to Pascal, and was testing and generating hashes for some folders
I've got a div by 0, so after some debugging and comparing with sources here I found that this version has the same bug.
If in find_quartile where vars q1,q2,q3 are calculated, q3 is setup to 0, then a div by 0 is generated when calculating q1ratio and q2ratio.
I tested with the file thas was causing me the problem and fails here also, I see you report a WARNING_CANNOT_HASH error in this case.
How could this be fixed? Is there further logic in the case q3 is 0 after find_quartile is called?

Thanks guys!

[jonjoliver]

Thank you.
This sounds very important to fix because in other languages / in other environments it might crash / might create vulnerabilities.

I will fix ASAP - while keeping maximum backwards compatibility.
Could you share the input file that creates this behaviour?

Also, do you want to share the Pascal version in this repo ?

cheers
jono

[bleuge]

Hi, I've just got this error testing against some MSDOS files, as I want to try to detect specific files (or similar) in a huge MSDOS repo. Where could I upload some example files?
Also, no problem sharing here the pascal version, it's a small library with just the basic functions to calc tlsh, and converting from tlsh->string and viceversa. But it works :D

About the q3=0 error, also happens in the go version as the logic is the same. What I am doing now is just detecting if find_quartile is returning q3=0, if so, just skip the file. As the same case if the length of file is <50.

[jonjoliver]

Hi
I generated the following single line file on Linux
1234560000000000000000000000000000000000000000000
This file has q1 = q2 = q3 = 0

I have considered - I think if q3 = 0, then there is no sensible TLSH digest
So I will add to the logic
If q3 == 0 then
return no_valid_hash

[bleuge]

Ok, I'll do the same then. If q3 ==0 then there is not a valid hash.

[jonjoliver]

resolved