GNOME Bugzilla – Bug 642445
[PATCH] Segfault when tip_of_the_day.list is empty
Last modified: 2018-06-29 22:53:44 UTC
As reported by pjama on IRC, when the tip_of_the_day.list file is empty, Gnucash crashes with a segfault. Here's what happens: 1. gnc_totd_initialize reads in the empty file, splits it into 0 tips. This sets tip_list to an empty vector (e.g., tip_list[0] is NULL). tip_count is set to 0 as well. 2. gnc_new_tip_number tries to display tip 0, which doesn't exist. This feeds tip_list[0] (which is NULL) into g_strsplit, causing it to return NULL and print: CRIT <GLib> file gstrfuncs.c: line 2403: assertion `string != NULL' failed 3. Finally, gnc_new_tip_number indexes tip_components, which is now NULL, and segfaults: tip = g_strdup_printf( _(tip_components[0]), tip_components[1]); So, gnc_new_tip_number doesn't handle the tip_count == 0 properly. However, since it doesn't quite make sense to display the tips dialog at all when there are no tips to display, it makes more sense to simply not display the dialog then to fix gnc_new_tip_number. I've attached a patch that does this. When no tips were found, it makes gnc_totd_initialize print an error and return FALSE, just like when the file could not be read. Additionally, the patch also changes gnc_new_tip_number to handle empty tips (which can be introduced by including a line with just whitespace in the tip_of_the_day.list file) more gracefully. It seems these did not result in a crash per se, but they would cause an out-of-bounds array access, so it's better to fix this. Finally, the patch removes the unused tip_args variable. Bug was found in 2.4.2. Patch is against the slightly older git revision 88ac0dc76436ba3486a6, but I expect it will apply cleanly to git master.
Created attachment 180978 [details] [review] Patch to make tip of the day handling more robust
Committed in r20303. I did forget to attribute you though. My apologies. If you prefer, I can revert the commit and redo it with proper attribution. Just let me know.
GnuCash bug tracking has moved to a new Bugzilla host. This bug has been copied to https://bugs.gnucash.org/show_bug.cgi?id=642445. Please update any external references or bookmarks.