bugunrtf - Bugs: bug #21721, attrstack_drop() crashes on bottom...


bug #21721: attrstack_drop() crashes on bottom stack of stacks.

Submitted by:  None
Submitted on:  Tue Dec 4 20:40:53 2007  
Votes:  100  
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: NoneOriginator Email: -unavailable-
Open/Closed: ClosedRelease: None

Add a New Comment (Rich MarkupRich Markup):

You are not logged in

Please log in, so followups can be emailed to you.


Tue Dec 16 07:38:36 2014, comment #4:

Thanks, fixed in current code.

Jean-Francois Dockes <medoc>
Project Administrator
Tue Jul 27 15:59:25 2010, comment #3:

I've also encountered this issue; however, I believe that the suggested patches are not the correct way of fixing the bug. I'm attaching my own patch to the issue which handles the bottom of the stack when prev_stack == stack instead of trying to alter how prev_stack is iterated. It also fixes a void return from a non-void function which caused a crash when my fix was applied.

(file #21086)

Mike Slegeir <mslegeir>
Wed Dec 24 11:43:49 2008, comment #2:

I experienced the same crash when converting an RTF to HTML, and the alteration suggested in comment #1 fixed the problem for me with this file. I hope this fix may be incorporated soon.

William Gallafent <gallafent>
Thu Jan 17 22:38:49 2008, comment #1:

That change still doesn't work quite right from what I can see. It still never hits the code that sets both stack_of_stacks_top and stack_of_stacks to null when the last stack is dropped.

I had better luck leaving that line as is, and changing the next line to say:

while(prev_stack && prev_stack->next != stack)

This allows prev_stack to become null when the last entry is dropped and works for all the test cases I've found so far.

Peter Fales <psfales>
Tue Dec 4 20:40:53 2007, original submission:

When dropping the bottom stack of stacks in attrstack_drop(), the logic will never set stack_of_stacks to NULL, but will free the bottom stack of stacks, causing attrstack_express_all() to dereference bad memory in some files.

I believe the line
prev_stack = stack_of_stacks;
should read
prev_stack = stack_of_stacks->next;
for the logic to work as intended.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #21086:  memory-error.patch added by mslegeir (600B - text/x-patch - Check prev_stack != stack rather than NULL, return NULL for non-void function.)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by medoc (Posted a comment)
  • -unavailable- added by mslegeir (Updated the item)
  • -unavailable- added by gallafent (Posted a comment)
  • -unavailable- added by gallafent (Voted in favor of this item)
  • -unavailable- added by psfales
  • -unavailable- added by psfales (Posted a comment)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 100 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue Dec 16 07:38:36 2014medocStatusNone=>Fixed
    Tue Jul 27 15:59:25 2010mslegeirAttached File-=>Added memory-error.patch, #21086
    Wed Dec 24 11:33:34 2008gallafentCarbon-Copy-=>Added gallafent
    Thu Jan 17 22:39:12 2008psfalesCarbon-Copy-=>Added psfales

    Back to the top

    Powered by Savane 3.1-cleanup1