bugunrtf - Bugs: bug #21721, attrstack_drop() crashes on bottom...


bug #21721: attrstack_drop() crashes on bottom stack of stacks.

Submitted by:  None
Submitted on:  Tue 04 Dec 2007 08:40:53 PM UTC  
Votes:  100  
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  None Originator Email:  -email is unavailable-
Open/Closed:  Closed Release:  None

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Tue 16 Dec 2014 07:38:36 AM UTC, comment #4:

Thanks, fixed in current code.

Jean-Francois Dockes <medoc>
Project Administrator
Tue 27 Jul 2010 03:59:25 PM UTC, comment #3:

I've also encountered this issue; however, I believe that the suggested patches are not the correct way of fixing the bug. I'm attaching my own patch to the issue which handles the bottom of the stack when prev_stack == stack instead of trying to alter how prev_stack is iterated. It also fixes a void return from a non-void function which caused a crash when my fix was applied.

(file #21086)

Mike Slegeir <mslegeir>
Wed 24 Dec 2008 11:43:49 AM UTC, comment #2:

I experienced the same crash when converting an RTF to HTML, and the alteration suggested in comment #1 fixed the problem for me with this file. I hope this fix may be incorporated soon.

William Gallafent <gallafent>
Thu 17 Jan 2008 10:38:49 PM UTC, comment #1:

That change still doesn't work quite right from what I can see. It still never hits the code that sets both stack_of_stacks_top and stack_of_stacks to null when the last stack is dropped.

I had better luck leaving that line as is, and changing the next line to say:

while(prev_stack && prev_stack->next != stack)

This allows prev_stack to become null when the last entry is dropped and works for all the test cases I've found so far.

Peter Fales <psfales>
Tue 04 Dec 2007 08:40:53 PM UTC, original submission:

When dropping the bottom stack of stacks in attrstack_drop(), the logic will never set stack_of_stacks to NULL, but will free the bottom stack of stacks, causing attrstack_express_all() to dereference bad memory in some files.

I believe the line
prev_stack = stack_of_stacks;
should read
prev_stack = stack_of_stacks->next;
for the logic to work as intended.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #21086:  memory-error.patch added by mslegeir (600B - text/x-patch - Check prev_stack != stack rather than NULL, return NULL for non-void function.)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by medoc (Posted a comment)
  • -email is unavailable- added by mslegeir (Updated the item)
  • -email is unavailable- added by gallafent (Posted a comment)
  • -email is unavailable- added by gallafent (Voted in favor of this item)
  • -email is unavailable- added by psfales
  • -email is unavailable- added by psfales (Posted a comment)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 100 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-16 medoc StatusNone => Fixed
        Open/ClosedOpen => Closed
    2010-07-27 mslegeir Attached File- => Added memory-error.patch, #21086
    2008-12-24 gallafent Carbon-Copy- => Added gallafent
    2008-01-17 psfales Carbon-Copy- => Added psfales

    Back to the top

    Powered by Savane 3.3