GNOME Bugzilla – Bug 628522
invalid access off end of array in e_bit_array_delete()
Last modified: 2013-09-13 01:05:47 UTC
==25576== 2 errors in context 2 of 18630: ==25576== Invalid read of size 4 ==25576== at 0x6B3EF8B: e_bit_array_delete_real (e-bit-array.c:94) ==25576== by 0x6B3F12F: e_bit_array_delete (e-bit-array.c:119) ==25576== by 0x5BD8CD2: e_selection_model_array_delete_rows (e-selection-model-array.c:81) ==25576== by 0x570A877: model_rows_deleted (e-table-selection-model.c:163) ==25576== by 0x3D3DE0E50D: g_closure_invoke (gclosure.c:766) ==25576== by 0x3D3DE2000A: signal_emit_unlocked_R (gsignal.c:3252) ==25576== by 0x3D3DE29B49: g_signal_emit_valist (gsignal.c:2983) ==25576== by 0x3D3DE29CF2: g_signal_emit (gsignal.c:3040) ==25576== by 0xEC221F6: process_added (e-cal-model.c:1757) ==25576== by 0xEC1FAF7: process_event (e-cal-model.c:1959) ==25576== by 0xEC1FCD5: e_cal_view_objects_added_cb (e-cal-model.c:1987) ==25576== by 0xEC2016F: process_modified (e-cal-model.c:1867) ==25576== Address 0x25019664 is 0 bytes after a block of size 4 alloc'd ==25576== at 0x4A05255: realloc (vg_replace_malloc.c:476) ==25576== by 0x3D3D645D4D: g_realloc (gmem.c:181) ==25576== by 0x6B3F00D: e_bit_array_delete_real (e-bit-array.c:105) ==25576== by 0x6B3F12F: e_bit_array_delete (e-bit-array.c:119) ==25576== by 0x5BD8CD2: e_selection_model_array_delete_rows (e-selection-model-array.c:81) ==25576== by 0x570A877: model_rows_deleted (e-table-selection-model.c:163) ==25576== by 0x3D3DE0E50D: g_closure_invoke (gclosure.c:766) ==25576== by 0x3D3DE2000A: signal_emit_unlocked_R (gsignal.c:3252) ==25576== by 0x3D3DE29B49: g_signal_emit_valist (gsignal.c:2983) ==25576== by 0x3D3DE29CF2: g_signal_emit (gsignal.c:3040) ==25576== by 0xEC221F6: process_added (e-cal-model.c:1757) ==25576== by 0xEC1FAF7: process_event (e-cal-model.c:1959) ==25576==
*** Bug 629909 has been marked as a duplicate of this bug. ***
Because a patch is there for this. *** This bug has been marked as a duplicate of bug 629459 ***
Created attachment 170474 [details] [review] fix off-by-one From the third comment onwards in bug 629459, where we start talking about e-bit-array potentially causing memory corruption, seems to be a red herring. It would only ever *read* from outside its array. The originally-reported bug hasn't really been addressed. So I'm filing this patch for the e-bit-array off-by-one error here. While we're at it, also check that the bit we're being asked to delete is actually within the bit array.
Created attachment 170480 [details] [review] updated patch; check eba->bit_count > 0, not > row Checking the 'row' input for sanity is outside the scope of this patch and should be done elsewhere. Let's just change the check from >=0 to >0 to ensure that we don't underflow.
Reopening due to (my) bad approach from the other bug.
The change looks good. Please commit to master and keep commit to gnome-2-32 after the hard code freeze. Thanks.
*** Bug 629459 has been marked as a duplicate of this bug. ***
Created commit a86159e in evo gnome-2-32 (2.32.1+)
*** Bug 631089 has been marked as a duplicate of this bug. ***
(In reply to comment #8) > Created commit a86159e in evo gnome-2-32 (2.32.1+) Why did this fix not make it into 2.30.xx, since this is the version delivered with the latest ubuntu maverick?
Ask Ubuntu. We support 2.32 now.
(In reply to comment #11) > Ask Ubuntu. We support 2.32 now. Just filed a bug report at https://bugs.launchpad.net/ubuntu/+source/evolution/+bug/663618.
*** Bug 637542 has been marked as a duplicate of this bug. ***
*** Bug 639225 has been marked as a duplicate of this bug. ***