bugTransport Sample Protocol - Bugs: bug #22113, Crash when double clicking on...

 
 

bug #22113: Crash when double clicking on variable in 2D plot

Submitter:  Robert de Vries <rhdv>
Submitted:  Fri 25 Jan 2008 03:10:08 PM UTC
   
 
Category:  Targa/GDisp+ Severity:  4 - Important
Priority:  5 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release:  * 0.8.3
Fixed Release:  * Unknown
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Fri 25 Jan 2008 03:10:08 PM UTC, original submission:  

When I double click on a variable name in a 2D plot an assertion failure happens, followed by a segmentation violation:
GLib-CRITICAL **: file garray.c: line 343 (g_ptr_array_remove_index): assertion `index < array->len' failed.
Segmentation fault (core dumped)

GDB stack trace:
#0  0x08062ece in dparray_freeSampleArray (pArray=0x0)
    at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_pointArray.c:56
#1  0x08068828 in gdisp_deleteSelectedSymbolName (kernel=0x8eb1680, plot=0x8f0c178, xMouse=49, yMouse=11, isShifted=0)
    at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_plot2D.c:552
#2  0x08068ba3 in gdisp_symbolNameWindowEvent (xevent=0xbfe1fd88, event=0x8eb0690, data=0x8eb1680)
    at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_plot2D.c:770
#3  0x00126d11 in gdk_get_show_events () from /usr/lib/libgdk-1.2.so.0
#4  0x0012818f in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#5  0x00128f78 in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#6  0x00129007 in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#7  0x00b04e49 in g_main_add_poll () from /usr/lib/libglib-1.2.so.0
#8  0x00b056dd in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#9  0x00b058df in g_main_run () from /usr/lib/libglib-1.2.so.0
#10 0x00c3e74f in gtk_main () from /usr/lib/libgtk-1.2.so.0
#11 0x080508c1 in main (argc=2, argv=0xbfe20024) at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_main.c:344

The segmentation violation comes from the freeing of a NULL pointer returned by g_ptr_array_remove_index() on line 550 of gdisp+/gdisp_plot2D.c
The return value is not checked for a NULL pointer.
The call dparray_freeSampleArray() does not check if the pointer passed to it is a NULL pointer too.
Therefore when dereferencing it, it crashes on line 56 of gdisp+/gdisp_pointArray.c

Robert de Vries <rhdv>
Group Member

 

Attached Files

This item currently has no attached files.

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by rhdv (Submitted the item)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

    History

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.16-598c.
    Corresponding source code