Re: [Chicken-users] segfault bug in string->number

[felix winkelmann]

On 2/1/07, felix winkelmann <address@hidden> wrote:
> On 2/1/07, Robin Lee Powell <address@hidden> wrote:
> >
> > The following output occurs:
> >
> > address@hidden> csc -O2 -d0 /tmp/stn.scm ; /tmp/stn
> > 4107
> > #f
> > 5065
> > zsh: segmentation fault  /tmp/stn
> >
> > I'm not going to try to patch it, because I *loathe* C.  In fact,
> > I'm using Scheme largely *because* I loathe C (I'm replacing bits of
> > C in the project I'm working on with it).
>
> And right you are about loathing it, because otherwise you might even
> make mistakes like this:
>
> % darcs diff runtime.c
> 7278c7278
> <   C_memcpy(sptr = buffer, C_c_string(str), n);
> ---
> >   C_memcpy(sptr = buffer, C_c_string(str), n > (STRING_BUFFER_SIZE - 1) ? 
> STRING_BUFFER_SIZE : n);

Or mistakes likes this:

% darcs diff -u runtime.c
--- old-chicken/runtime.c       2007-02-02 08:46:14.093143632 +0100
+++ new-chicken/runtime.c       2007-02-02 08:46:14.247120224 +0100
@@ -7275,6 +7275,11 @@
    goto fini;
  }

+  if(n >= STRING_BUFFER_SIZE - 1) {
+    n = C_SCHEME_FALSE;
+    goto fini;
+  }
+
  C_memcpy(sptr = buffer, C_c_string(str), n);
  buffer[ n ] = '\0';


cheers,
felix