GNOME Bugzilla – Bug 406284
array bounds read in StringView::strchr
Last modified: 2007-02-10 02:41:36 UTC
This showed up in a valgrind report submitted by Bruno Barberi Gnecco in bug #371405. Since it doesn't directly relate to that bug, I'm opening a separate ticket for it. The bug reported is this: =4104== Invalid read of size 1 ==4104== at 0x401E450: memchr (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==4104== by 0x80C10FC: (anonymous namespace)::append_text_buffer_nolock(pan::TextMassager const*, _GtkTextBuffer*, pan::StringV iew const&, bool, bool, bool) (in /usr/local/bin/pan) ==4104== by 0x80C1B27: pan::BodyPane::append_part(_GMimeObject*, _GdkRectangle*) (in /usr/local/bin/pan) ==4104== Address 0x5FC0BD9 is 0 bytes after a block of size 65 alloc'd ==4104== at 0x401C802: operator new(unsigned) (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==4104== by 0x4657215: std::string::_Rep::_S_create(unsigned, unsigned, std::allocator<char> const&) (in /usr/lib/libstdc++.so. 6.0.3) ==4104== by 0x46579CB: std::string::_M_mutate(unsigned, unsigned, unsigned) (in /usr/lib/libstdc++.so.6.0.3) ==4104== by 0x4657CBD: std::string::assign(char const*, unsigned) (in /usr/lib/libstdc++.so.6.0.3) ==4104== by 0x80C0CB0: (anonymous namespace)::append_text_buffer_nolock(pan::TextMassager const*, _GtkTextBuffer*, pan::StringV iew const&, bool, bool, bool) (in /usr/local/bin/pan) ==4104== by 0x80C1B27: pan::BodyPane::append_part(_GMimeObject*, _GdkRectangle*) (in /usr/local/bin/pan) ==4104== by 0x80C1DF3: pan::BodyPane::foreach_part_cb(_GMimeObject*, void*) (in /usr/local/bin/pan) ==4104== by 0x456063B: g_mime_multipart_foreach (gmime-multipart.c:739)
Created attachment 82261 [details] [review] patch to fix