bugTransport Sample Protocol - Bugs: bug #22113, Crash when double clicking on...

 
 

bug #22113: Crash when double clicking on variable in 2D plot

Submitter:  Robert de Vries <rhdv>
Submitted:  Fri 25 Jan 2008 03:10:08 PM UTC
   
 
Category:  Targa/GDisp+ Severity:  4 - Important
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Release:  * 0.8.3 Fixed Release:  * Unknown
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 25 Jan 2008 03:10:08 PM UTC, original submission:  

When I double click on a variable name in a 2D plot an assertion failure happens, followed by a segmentation violation:
GLib-CRITICAL **: file garray.c: line 343 (g_ptr_array_remove_index): assertion `index < array->len' failed.
Segmentation fault (core dumped)

GDB stack trace:
#0  0x08062ece in dparray_freeSampleArray (pArray=0x0)
    at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_pointArray.c:56
#1  0x08068828 in gdisp_deleteSelectedSymbolName (kernel=0x8eb1680, plot=0x8f0c178, xMouse=49, yMouse=11, isShifted=0)
    at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_plot2D.c:552
#2  0x08068ba3 in gdisp_symbolNameWindowEvent (xevent=0xbfe1fd88, event=0x8eb0690, data=0x8eb1680)
    at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_plot2D.c:770
#3  0x00126d11 in gdk_get_show_events () from /usr/lib/libgdk-1.2.so.0
#4  0x0012818f in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#5  0x00128f78 in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#6  0x00129007 in gdk_events_init () from /usr/lib/libgdk-1.2.so.0
#7  0x00b04e49 in g_main_add_poll () from /usr/lib/libglib-1.2.so.0
#8  0x00b056dd in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#9  0x00b058df in g_main_run () from /usr/lib/libglib-1.2.so.0
#10 0x00c3e74f in gtk_main () from /usr/lib/libgtk-1.2.so.0
#11 0x080508c1 in main (argc=2, argv=0xbfe20024) at /home/rv62021/rpmbuild/BUILD/tsp-0.8.3-Source/src/consumers/gdisp+/gdisp_main.c:344

The segmentation violation comes from the freeing of a NULL pointer returned by g_ptr_array_remove_index() on line 550 of gdisp+/gdisp_plot2D.c
The return value is not checked for a NULL pointer.
The call dparray_freeSampleArray() does not check if the pointer passed to it is a NULL pointer too.
Therefore when dereferencing it, it crashes on line 56 of gdisp+/gdisp_pointArray.c

Robert de Vries <rhdv>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rhdv (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code