Opening of some MusicXML files caused MuseScore to crash

• May 4, 2018 - 19:10
Reported version
S2 - Critical

Opening of some MusicXML files created by PhotoScore caused MuseScore to crash silently. Inspecting those XML files showed that they had parts that were different in length in terms of measures. Making parts length equal solved the problem of crashes. I guess not every user can fix XML files, which are well-formed, but has content inconsistencies.

Attachment Size
Kuratsa36.xml 174.75 KB


Severity S4 - Minor S2 - Critical
Reported version 2.1

2.1 crashes on this, so no regression in 2.2.
current master crashes too, stack trace:
1 Ms::Element::track element.h 295 0xe06fd0
2 Ms::addTupletToChord importmxmlpass2.cpp 1079 0x453433
3 Ms::MusicXMLParserPass2::note importmxmlpass2.cpp 4513 0x466713
4 Ms::MusicXMLParserPass2::measure importmxmlpass2.cpp 2027 0x457970
5 Ms::MusicXMLParserPass2::part importmxmlpass2.cpp 1700 0x4562eb
6 Ms::MusicXMLParserPass2::scorePartwise importmxmlpass2.cpp 1590 0x45586e
7 Ms::MusicXMLParserPass2::parse importmxmlpass2.cpp 1559 0x45569d
8 Ms::MusicXMLParserPass2::parse importmxmlpass2.cpp 1540 0x455628
9 Ms::importMusicXMLfromBuffer importmxml.cpp 55 0x43f332
10 Ms::doValidateAndImport importxml.cpp 233 0x644858
11 Ms::importMusicXml importxml.cpp 263 0x644a0d
12 Ms::readScore file.cpp 2188 0x5d5d24
13 Ms::MuseScore::readScore file.cpp 329 0x5c4c1a
14 Ms::MuseScore::openScore file.cpp 310 0x5c4af4
15 Ms::MuseScore::loadFiles file.cpp 291 0x5c47d5
16 Ms::MuseScore::cmd musescore.cpp 4889 0x4b28a6
17 Ms::MuseScore::cmd musescore.cpp 4743 0x4b1eb9
18 Ms::MuseScore::qt_static_metacall moc_musescore.cpp 738 0x6e3bdf
19 ZN11QMetaObject8activateEP7QObjectiiPPv 0x68c7b972
20 ZN12QActionGroup7hoveredEP7QAction 0x20774d75

The issue is triggered by a sequence of notes that overlaps with itself (measure 71 voice 2). The triplet is followed by a backup that tries to place the following 64th rest on top of the last triplet note. This is disallowed by MuseScore, but the error handling is incorrect, causing the crash.

Fix is simple, see pull request