GNOME Bugzilla – Bug 160865
segfault in line wrapping code of UML class drawing
Last modified: 2005-06-26 09:04:09 UTC
Create a class, enter a method with such a large argument list that won't fit in a single line. Let the last argument be longer than the wrap length. When dia tries to draw it, a segfault happens.
Created attachment 34660 [details] [review] Patch for buffer overflow in line wrapping code of UML classes The temporary buffer for partial lines was too small, it didn't contain space for leading indentation.
Created attachment 34661 [details] [review] Patch for buffer overflow in line wrapping code of UML classes Partial line buffer didn't contain space for leading indentation.
Thanks, applied. 2004-12-11 Hans Breuer <hans@breuer.org> * objects/UML/class.c : line wrapping code buffer overrun fixed by Gabor Simon, bug #160865
*** Bug 161184 has been marked as a duplicate of this bug. ***
There's one more instance, in line 516. Gabor, ou probably understand the code better than I, after fixing the first one. Please let me know if you don't intend to fix it.
*** Bug 300358 has been marked as a duplicate of this bug. ***
Created attachment 45211 [details] [review] Patch for eliminating the second occurence of this bug
Lars, I made a quick fix, but I can't test it (don't know how to activate the affected code), so if you can reproduce the error, check it again, please. Thanks.
Bug 300358 has diagrams that trigger the bug.
Created attachment 45242 [details] [review] Patch for the 2nd occurence of the bug (works)
I tried those diagrams, and they proved that my prev patch (id=45211) is worthless. However, I've sent another one (45242), which seems to cure the problem, now those diagrams can be edited without crashing. (Btw, I ran dia using valgrind, and it caught a lot of off-by-N bugs at various other places, too. Perhaps it's also worth a try when investigating other bugs.)
Setting PATCH keyword again.
Thanks, applied. 2005-04-23 Hans Breuer <hans@breuer.org> * objects/UML/class.c : fix another crash with the line wrapping code (Gabor Simon, bug #160865)
*** Bug 308737 has been marked as a duplicate of this bug. ***