[PATCH] Fixed invalid read in /HELP
Enrico Scholz <[email protected]> Sat, 1 Mar 2008 14:31:33 +0100
| Newsgroups | gmane.network.irc.irssi.devel |
|---|---|
| Message-ID | <1204378293-24300-1-git-send-email-enrico.scholz@informatik.tu-chemnitz.de> |
This patch fixes ==23538== Invalid read of size 1 ==23538== at 0x449731: cmd_help (fe-help.c:259) ==23538== by 0x4A44FD: signal_emit_real (signals.c:242) ==23538== by 0x4A4770: signal_emit (signals.c:286) ==23538== by 0x48D7C8: parse_command (commands.c:899) ==23538== by 0x48D948: event_command (commands.c:945) ==23538== by 0x4A44FD: signal_emit_real (signals.c:242) ==23538== by 0x4A4770: signal_emit (signals.c:286) ==23538== by 0x41B0B0: key_send_line (gui-readline.c:548) ==23538== by 0x4A44FD: signal_emit_real (signals.c:242) ==23538== by 0x4A4770: signal_emit (signals.c:286) ==23538== by 0x4588D6: sig_multi (keyboard.c:637) ==23538== by 0x4A44FD: signal_emit_real (signals.c:242) ==23538== Address 0x9D116F7 is 1 bytes before a block of size 1 alloc'd ==23538== at 0x4A059F6: malloc (vg_replace_malloc.c:149) ==23538== by 0x34306362AA: g_malloc (in /lib64/libglib-2.0.so.0.1400.6) ==23538== by 0x343064D35E: g_strdup (in /lib64/libglib-2.0.so.0.1400.6) ==23538== by 0x4496F0: cmd_help (fe-help.c:257) ==23538== by 0x4A44FD: signal_emit_real (signals.c:242) ==23538== by 0x4A4770: signal_emit (signals.c:286) ==23538== by 0x48D7C8: parse_command (commands.c:899) ==23538== by 0x48D948: event_command (commands.c:945) ==23538== by 0x4A44FD: signal_emit_real (signals.c:242) ==23538== by 0x4A4770: signal_emit (signals.c:286) ==23538== by 0x41B0B0: key_send_line (gui-readline.c:548) ==23538== by 0x4A44FD: signal_emit_real (signals.c:242) which happens when executing a plain '/HELP'. --- src/fe-common/core/fe-help.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/fe-common/core/fe-help.c b/src/fe-common/core/fe-help.c index 76e4c6d..98dfab9 100644 --- a/src/fe-common/core/fe-help.c +++ b/src/fe-common/core/fe-help.c @@ -255,8 +255,12 @@ static void cmd_help(const char *data) char *cmd, *ptr; cmd = g_strdup(data); - ptr = cmd+strlen(cmd); - while (ptr[-1] == ' ') ptr--; *ptr = '\0'; + ptr = cmd + strlen(cmd); + + while (ptr>cmd && ptr[-1] == ' ') + --ptr; + + *ptr = '\0'; g_strdown(cmd); show_help(cmd); -- 1.5.4.1