bugTransport Sample Protocol - Bugs: bug #22113, Crash when double clicking on...

 
 

bug #22113: Crash when double clicking on variable in 2D plot

Submitted by:  Robert de Vries <rhdv>
Submitted on:  Fri 25 Jan 2008 03:10:08 PM UTC  
 
Category: Targa/GDisp+Severity: 4 - Important
Status: NonePrivacy: Public
Assigned to: NoneOpen/Closed: Open
Release: 0.8.3Fixed Release: Unknown

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 25 Jan 2008 03:10:08 PM UTC, original submission:

When I double click on a variable name in a 2D plot an assertion failure happens, followed by a segmentation violation:
GLib-CRITICAL **: file garray.c: line 343 (g_ptr_array_remove_index): assertion `index < array->len' failed.
Segmentation fault (core dumped)

GDB stack trace:
#0 0x08062ece in dparray_freeSampleArray (pArray=0x0)
at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_pointArray.c:56
#1 0x08068828 in gdisp_deleteSelectedSymbolName (kernel=0x8eb1680, plot=0x8f0c178, xMouse=49, yMouse=11, isShifted=0)
at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_plot2D.c:552
#2 0x08068ba3 in gdisp_symbolNameWindowEvent (xevent=0xbfe1fd88, event=0x8eb0690, data=0x8eb1680)
at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_plot2D.c:770
#3 0x00126d11 in gdk_get_show_events () from /usr/lib/libgdk-1.2.so.0
#4 0x0012818f in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#5 0x00128f78 in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#6 0x00129007 in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#7 0x00b04e49 in g_main_add_poll () from /usr/lib/libglib-1.2.so.0
#8 0x00b056dd in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#9 0x00b058df in g_main_run () from /usr/lib/libglib-1.2.so.0
#10 0x00c3e74f in gtk_main () from /usr/lib/libgtk-1.2.so.0
#11 0x080508c1 in main (argc=2, argv=0xbfe20024) at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_main.c:344

The segmentation violation comes from the freeing of a NULL pointer returned by g_ptr_array_remove_index() on line 550 of gdisp+/gdisp_plot2D.c
The return value is not checked for a NULL pointer.
The call dparray_freeSampleArray() does not check if the pointer passed to it is a NULL pointer too.
Therefore when dereferencing it, it crashes on line 56 of gdisp+/gdisp_pointArray.c

Robert de Vries <rhdv>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rhdv (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup1