Re: Bugs in fillHole ?

[Richard Frith-Macdonald]

On Monday, February 17, 2003, at 12:41  pm, Manuel Guesdon wrote:

> Hi,
>
> I've tried valgrind to find memory problems and found problems in 
> GSSTring.m fillHole.
> ==20804== Invalid read of size 1
> ==20804==    at 0x40CD337A: fillHole (GSString.m:1065)
> ==20804==    by 0x40CCDFF1: 
> _i_GSMutableString__deleteCharactersInRange_ (GSString.m:2700)
> ==20804==    by 0x40573359: 
> _i_GSWDynamicURLString_GSWDynamicURLStringParsing__compose 
> (GSWDynamicURLString.m:328)
> ==20804==    by 0x405730A6: _i_GSWDynamicURLString__description 
> (GSWDynamicURLString.m:292)
>
> I get it when
>         self->_count=75, index=0, size=75 self->_flags.wide=0
> but I don't understand why :-(

A boundary error in the copying code.

> I've looked also at  STABLE_MEMCPY code and I think memcpy src and dst 
> arguments
> are inversed. Aren't they ?

Wow,  how could that bug go unnoticed?

I'll commit a fix to the freeze-1_6_0 branch of CVS