After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 153759 - egg_desktop_entries_get_locale_country has severe pointer arithmetic problems
egg_desktop_entries_get_locale_country has severe pointer arithmetic problems
Status: RESOLVED FIXED
Product: libegg
Classification: Other
Component: menu
unspecified
Other Linux
: High critical
: ---
Assigned To: Ray Strode [halfline]
Ray Strode [halfline]
Depends on:
Blocks:
 
 
Reported: 2004-09-26 07:44 UTC by Nicholas Miell
Modified: 2004-12-22 21:47 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Nicholas Miell 2004-09-26 07:44:26 UTC 
(Component picked at random because bugzilla made me do it.)

The function egg_desktop_entries_get_locale_country, found in
libegg/libegg/desktopentries/eggdesktopentries.c, contains the following:

  q = strstr (p, ".");

  if (!q)
    q = strstr (p, "@");

  if (!q)                           *** ERROR ***
    country_len = q - p;
  else
    country_len = strlen (p);

The marked line needs to be changed to "if (q)", otherwise the g_new/strndup
combination below will end up allocating and commiting fun amounts of RAM in the
 multi-gigabyte ranges.

Not understanding what exactly this function is trying to do, my proposed fix
may be wrong.
Comment 1 James Henstridge 2004-09-27 03:47:08 UTC 
Reassigning to the eggdesktopentries author.
Comment 2 Ray Strode [halfline] 2004-09-27 17:29:01 UTC 
Thanks for spotting this.  It should be fixed now:

2004-09-27  Ray Strode  <rstrode@redhat.com>

        * libegg/desktopentries/eggdesktopentries.c
        (egg_desktop_entries_get_locale_country):
        Swap if and else clauses to prevent misallocating
        gigabytes of memory (Spotted by Nicholas Miell,
        bug #153759).
Comment 3 Nicholas Miell 2004-09-27 21:35:17 UTC 
Well, I managed to thrash my box to death again, and in looking at
eggdesktopentries.c, I found a similar error in 
egg_desktop_entries_get_locale_encoding.

After checking every other instance of g_new, I'm pretty sure there aren't any
others.
Comment 4 Ray Strode [halfline] 2004-09-28 04:05:33 UTC 
ugh.  Thanks again.  Should be fixed in CVS.