bugDenemo - Bugs: bug #62243, do_search_replace in...

 
 

bug #62243: do_search_replace in src/ui/texteditors.c reads uninitialized memory

Submitter:  None
Submitted:  Thu 31 Mar 2022 10:00:11 PM UTC
   
 
Category:  None
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 11 Apr 2022 12:35:36 PM UTC, comment #2: 

Yeah this was found by a new tool, but it's not open source yet (and it's also not really user-friendly :) ).

Raphael Isemann <teemperor>
Fri 01 Apr 2022 08:46:15 AM UTC, comment #1: 

Thanks for this, now fixed in source.
I'm intrigued about how you may have found this bug - do you have some useful code analysis tool?

Richard Shann <rshann>
Group administrator
Thu 31 Mar 2022 10:00:11 PM UTC, original submission:  

The function `do_search_replace` declares the variable `flags` for both GTK2 and GTK3 and lets the function `search_dialog` initialize the value of `flags`.


static void
do_search_replace (GtkTextView * view, gboolean replace)
{
  GtkTextBuffer *buffer = gtk_text_view_get_buffer (view);
  GtkTextIter iter;
  char *what, *replacement;
#if GTK_MAJOR_VERSION==3
  GtkTextSearchFlags flags;  // DECLARED HERE
#else
  GtkSourceSearchFlags flags;  // DECLARED HERE
#endif

  // 'flags' INITIALIZED IN FUNCTION BELOW
  if (!search_dialog (GTK_WIDGET (view), replace, &what, &replacement, &flags))
    return;

  if (replace)
    {
      gtk_text_buffer_get_iter_at_offset (buffer, &iter, 0);

      while (TRUE)
        {
          GtkTextIter match_start, match_end;
#if GTK_MAJOR_VERSION==3
          // USED HERE UNITIALIZED
          if (!gtk_text_iter_forward_search (&iter, what, flags, &match_start, &match_end, NULL))
#else


But `search_dialog` only initializes the value in GTK2, so when compiling with GTK3, `flags` is just some initialized value.


#if GTK_MAJOR_VERSION==3
static gboolean
search_dialog (GtkWidget * widget, gboolean replace, char **what_p, char **replacement_p, GtkTextSearchFlags * flags_p)
#else
static gboolean
search_dialog (GtkWidget * widget, gboolean replace, char **what_p, char **replacement_p, GtkSourceSearchFlags * flags_p)
#endif
{
  // [removed other code]
#if GTK_MAJOR_VERSION==2
  *flags_p = search_data.flags = gtk_toggle_button_get_active (case_sensitive) ? 0 : GTK_SOURCE_SEARCH_CASE_INSENSITIVE;
#endif
  gtk_widget_destroy (dialog);
  return TRUE;
}


This seems to happen in master (and the latest release in Ubuntu).

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by teemperor (Posted a comment)
  • -email is unavailable- added by rshann (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-04-01 rshann StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.12.
    Corresponding source code