bugunrtf - Bugs: bug #21721, attrstack_drop() crashes on bottom...

 
 

bug #21721: attrstack_drop() crashes on bottom stack of stacks.

Submitter:  None
Submitted:  Tue 04 Dec 2007 08:40:53 PM UTC
Votes: 100
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  None Originator Email:  -email is unavailable-
Open/Closed:  Closed Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 16 Dec 2014 07:38:36 AM UTC, comment #4: 

Thanks, fixed in current code.

Jean-Francois Dockes <medoc>
Group administrator
Tue 27 Jul 2010 03:59:25 PM UTC, comment #3: 

I've also encountered this issue; however, I believe that the suggested patches are not the correct way of fixing the bug.  I'm attaching my own patch to the issue which handles the bottom of the stack when prev_stack == stack instead of trying to alter how prev_stack is iterated.  It also fixes a void return from a non-void function which caused a crash when my fix was applied.

(file #21086)

Mike Slegeir <mslegeir>
Wed 24 Dec 2008 11:43:49 AM UTC, comment #2: 

I experienced the same crash when converting an RTF to HTML, and the alteration suggested in comment #1 fixed the problem for me with this file. I hope this fix may be incorporated soon.

William Gallafent <gallafent>
Thu 17 Jan 2008 10:38:49 PM UTC, comment #1: 

That change still doesn't work quite right from what I can see.  It still never hits the code that sets both stack_of_stacks_top and stack_of_stacks to null when the last stack is dropped.

I had better luck leaving that line as is, and changing the next line to say:

while(prev_stack && prev_stack->next != stack)

This allows prev_stack to become null when the last entry is dropped and works for all the test cases I've found so far.

Peter Fales <psfales>
Tue 04 Dec 2007 08:40:53 PM UTC, original submission:  

When dropping the bottom stack of stacks in attrstack_drop(), the logic will never set stack_of_stacks to NULL, but will free the bottom stack of stacks, causing attrstack_express_all() to dereference bad memory in some files.

I believe the line
prev_stack = stack_of_stacks;
should read
prev_stack = stack_of_stacks->next;
for the logic to work as intended.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #21086:  memory-error.patch added by mslegeir (600B - text/x-patch - Check prev_stack != stack rather than NULL, return NULL for non-void function.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by medoc (Posted a comment)
  • -email is unavailable- added by mslegeir (Updated the item)
  • -email is unavailable- added by gallafent (Posted a comment)
  • -email is unavailable- added by gallafent (Voted in favor of this item)
  • -email is unavailable- added by psfales
  • -email is unavailable- added by psfales (Posted a comment)
  •  

    There are 100 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-16 medoc StatusNone Fixed
        Open/ClosedOpen Closed
    2010-07-27 mslegeir Attached File- Added memory-error.patch, #21086
    2008-12-24 gallafent Carbon-Copy- Added gallafent
    2008-01-17 psfales Carbon-Copy- Added psfales

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code