Re: Segmentation fault w/ Gnats 4.0.1

Chad Walstrom <[email protected]> Mon, 22 Nov 2004 13:48:49 -0600
Newsgroups gmane.comp.bug-tracking.gnats.bugs
Message-ID <[email protected]>
--===============0773237617==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="CE+1k2dSO48ffgeK"
Content-Disposition: inline


--CE+1k2dSO48ffgeK
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Pankaj Garg wrote:
> Haven't had a chance to explore further, but it seems that the problem
> was happening when there was only an '\n' for the third field
> (address) in the responsible file. Seems like the isspace logic is
> somehow getting messed up. Before I dig deeper, just wanted to see if
> someone else has experienced anything like this.

It's a reasonable hack.  I can't see a situation where the current
pointer would be less than addrStart, so comparing equality is probably
good enough, but I agree that the comparison is needed.

When a single character string (i.e. '\0') is passed to xstrndup (found
in misc.c) with a length specification of zero (i.e. addr - addrStart =3D=3D
0), you get Bad Things.  xstrndup() should probably validate the length
parameter to protect against this type of error.  It passes the same
length parameter to memcpy().  This is where gnatsd is probably
crashing.

Good catch.  Thanks!

--=20
Chad Walstrom <[email protected]>           http://www.wookimus.net/
           assert(expired(knowledge)); /* core dump */

--CE+1k2dSO48ffgeK
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBokKhDMcLGCBsWv0RAiN4AKDNA1CImjvpubee7u8y3UrSePGAKACgtQ4n
mXfY2fwjZgLmAJEDz2vMHZc=
=5yyk
-----END PGP SIGNATURE-----

--CE+1k2dSO48ffgeK--



--===============0773237617==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Bug-gnats mailing list
[email protected]
http://lists.gnu.org/mailman/listinfo/bug-gnats

--===============0773237617==--