[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[Pkg-fonts-devel] Bug#664789: Bug#664789: Bug#664789: [Fontforge-devel] Segmentation Fault after Hitting 'a<Tab>' as Test Pattern in the Kerning Metrics Window



Control: tags 664789 + patch

On 09/20/2012 08:37 AM, Fabian Greffrath wrote:
> Am 20.03.2012 22:27, schrieb Daniel Kahn Gillmor:
>> Steps to repeat:
>>
>>   From the menu, choose Window > New Metrics Window
>>
>> In the field with the text to display, type any character and then the
>> Tab key (or press the tab key and then any other character).
> 
> I was also able to reproduce this.
> 
>> The backtrace i get during the crash is:
>>
>>
>> #0  u_strncmp (str1=0x0, str2=0x87f6b90, n=0) at ustring.c:97
>> #1  0xb7baeb12 in GListField_NameCompletion (t=0x87f6930, from_tab=1)
>>      at gtextfield.c:3150
> 
> The problem seems to be that GListField_NameCompletion() dereferences
> ti[i]->text, which might be NULL. I have, however, no idea why this is so.

Well, without understanding the root of the problem, we could at least
avoid the dereference with something like the (untested) patch i've
attached here.

I haven't checked if this is still a problem in the latest upstream --
there's been a lot of activity there recently (yay!).  But debian should
still try to fix this sort of bug in the versions we support.

	--dkg
--- a/gdraw/gtextfield.c  2012-09-20 13:30:04.000000000 -0400
+++ b/gdraw/gtextfield.c  2012-09-20 13:31:07.000000000 -0400
@@ -3147,7 +3147,7 @@
     for ( doit=0; doit<2; ++doit ) {
        cnt=0;
        for ( i=0; i<len; ++i ) {
-           if ( u_strncmp(ti[i]->text,spt,match_len)==0 ) {
+           if ( ti[i]->text && u_strncmp(ti[i]->text,spt,match_len)==0 ) {
                if ( doit )
                    ret[cnt] = u_copy(ti[i]->text);
                ++cnt;

Attachment: signature.asc
Description: OpenPGP digital signature


Reply to: