bugGNU gettext - Bugs: bug #47991, memory errors in desktop_lex

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #47991: memory errors in desktop_lex

Submitter:  David Shea <dshea>
Submitted:  Mon 23 May 2016 06:03:06 PM UTC
   
 
Category:  Desktop Severity:  3 - Normal
Item Group:  None Status:  Fix Released
Privacy:  Public Assigned to:  ueno
Open/Closed:  Closed

Tue 24 May 2016 02:26:11 AM UTC, comment #2: 

Thanks for pointing that out.  I have pushed the patch with the same treatment for 'locale':
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=68ab0dafa99f1941b3ebb47b7cf969381e7310f4

Daiki Ueno <ueno>
Group administrator
Mon 23 May 2016 06:43:20 PM UTC, comment #1: 

I think I see what happened. Value is getting set to a position in buffer at read-desktop.c:431, but APPEND is called after that, which reallocs buffer and invalidates that pointer. Here's a possible patch:

diff --git a/gettext-tools/src/read-desktop.c b/gettext-tools/src/read-desktop.c
index 417c08a..c5a9b08 100644
--- a/gettext-tools/src/read-desktop.c
+++ b/gettext-tools/src/read-desktop.c
@@ -327,7 +327,7 @@ desktop_lex (token_ty *tp)
         case '5': case '6': case '7': case '8': case '9':
           {
             const char *locale = NULL;
-            const char *value = NULL;
+            size_t value_start = 0;
             for (;;)
               {
                 APPEND (c);
@@ -428,7 +428,7 @@ desktop_lex (token_ty *tp)
                 break;
               }
 
-            value = &buffer[bufpos];
+            value_start = bufpos;
             for (;;)
               {
                 c = phase2_getc ();
@@ -440,7 +440,7 @@ desktop_lex (token_ty *tp)
             tp->type = token_type_pair;
             tp->string = xmemdup (buffer, bufpos);
             tp->locale = locale;
-            tp->value = value;
+            tp->value = &buffer[value_start];
             return;
           }
         default:

David Shea <dshea>
Mon 23 May 2016 06:03:06 PM UTC, original submission:  

While attempting to merge translations into a .desktop file, one of the existing translations gets modified with a chunk of a new translation for a different string. The badly modified string is returned as token.value from desktop_lex, and that's as far as I went in trying to debug this.

With the attached files I ran:

msgfmt --desktop --template partial.desktop --locale da -o broken.desktop da.po

David Shea <dshea>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #37239:  partial.desktop added by dshea (164B - application/x-desktop)
file #37240:  broken.desktop added by dshea (225B - application/x-desktop)
file #37241:  da.po added by dshea (182KiB - text/x-gettext-translation)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by haible (Updated the item)
  • -email is unavailable- added by ueno (Posted a comment)
  • -email is unavailable- added by dshea (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-01-04 haible StatusFixed Fix Released
    2016-11-27 haible CategoryNone Desktop
        Assigned toNone ueno
    2016-05-24 ueno StatusNone Fixed
        Open/ClosedOpen Closed
    2016-05-23 dshea Attached File- Added partial.desktop, #37239
        Attached File- Added broken.desktop, #37240
        Attached File- Added da.po, #37241

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code