After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 493751 - unsafe code
unsafe code
Status: RESOLVED FIXED
Product: yelp
Classification: Applications
Component: General
unspecified
Other Linux
: Normal normal
: ---
Assigned To: Yelp maintainers
Yelp maintainers
: 480876 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2007-11-05 14:59 UTC by Matthias Clasen
Modified: 2007-11-07 19:27 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Matthias Clasen 2007-11-05 14:59:21 UTC 
yelp-search-parser.c:1075

    ptr = g_strrstr (container->base_filename, "/");

    path = g_strndup (container->base_filename,
                      ptr - container->base_filename);

will crash if the base_filename does not contain a '/'.

Better make that 

   if (ptr)
     /* do as before */
   else
     path = g_strdup (container->base_filename);

This was filed as causing crashes here:
https://bugzilla.redhat.com/show_bug.cgi?id=361041
Comment 1 Will Woods 2007-11-05 18:30:59 UTC 
container->base_filename is typically the contents of the "url" field of this item from the OMF file:

<identifier url="file:///usr/share/gnome/help/..." />

In some cases (e.g. the current virt-manager package in Fedora) we end up with something like:

<identifier url="" />

Which, obviously, contains no slashes. So the code needs to check for *empty* base_filename as well - or the function further up the stack needs to not pass empty strings.

Obviously the OMF file is incorrect but yelp shouldn't crash on malformed input.
Comment 2 Don Scorgie 2007-11-07 19:08:30 UTC 
Fixed in SVN Head:

2007-11-07  Don Scorgie  <dscorgie@svn.gnome.org>

	* src/yelp-search-parser.c: 
	Fix NULL-checking of URI in slow search
	(bug #493751)
Comment 3 Don Scorgie 2007-11-07 19:27:40 UTC 
*** Bug 480876 has been marked as a duplicate of this bug. ***