bugunrtf - Bugs: bug #21721, attrstack_drop() crashes on bottom...

 
 

bug #21721: attrstack_drop() crashes on bottom stack of stacks.

Submitted by:  None
Submitted on:  Tue 04 Dec 2007 08:40:53 PM UTC  
Votes:  100  
 
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: NonePrivacy: Public
Assigned to: NoneOriginator Email: -unavailable-
Open/Closed: OpenRelease: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 27 Jul 2010 03:59:25 PM UTC, comment #3:

I've also encountered this issue; however, I believe that the suggested patches are not the correct way of fixing the bug. I'm attaching my own patch to the issue which handles the bottom of the stack when prev_stack == stack instead of trying to alter how prev_stack is iterated. It also fixes a void return from a non-void function which caused a crash when my fix was applied.

(file #21086)

Mike Slegeir <mslegeir>
Wed 24 Dec 2008 11:43:49 AM UTC, comment #2:

I experienced the same crash when converting an RTF to HTML, and the alteration suggested in comment #1 fixed the problem for me with this file. I hope this fix may be incorporated soon.

William Gallafent <gallafent>
Thu 17 Jan 2008 10:38:49 PM UTC, comment #1:

That change still doesn't work quite right from what I can see. It still never hits the code that sets both stack_of_stacks_top and stack_of_stacks to null when the last stack is dropped.

I had better luck leaving that line as is, and changing the next line to say:

while(prev_stack && prev_stack->next != stack)

This allows prev_stack to become null when the last entry is dropped and works for all the test cases I've found so far.

Peter Fales <psfales>
Tue 04 Dec 2007 08:40:53 PM UTC, original submission:

When dropping the bottom stack of stacks in attrstack_drop(), the logic will never set stack_of_stacks to NULL, but will free the bottom stack of stacks, causing attrstack_express_all() to dereference bad memory in some files.

I believe the line
prev_stack = stack_of_stacks;
should read
prev_stack = stack_of_stacks->next;
for the logic to work as intended.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #21086:  memory-error.patch added by mslegeir (600B - text/x-patch - Check prev_stack != stack rather than NULL, return NULL for non-void function.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mslegeir (Updated the item)
  • -unavailable- added by gallafent (Posted a comment)
  • -unavailable- added by gallafent (Voted in favor of this item)
  • -unavailable- added by psfales
  • -unavailable- added by psfales (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 100 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 27 Jul 2010 03:59:25 PM UTCmslegeirAttached File-=>Added memory-error.patch, #21086
    Wed 24 Dec 2008 11:33:34 AM UTCgallafentCarbon-Copy-=>Added gallafent
    Thu 17 Jan 2008 10:39:12 PM UTCpsfalesCarbon-Copy-=>Added psfales

    Back to the top


    Powered by Savane 3.1-cleanup