Re: lynx-dev bug report

[Leonid Pauzner]

22-Jul-99 17:03 Perry Wagle wrote:
> In the lynx source that comes with redhat 5.2 and 6.0, in the file

I have no idea what lynx versions RedHat ships
but this problem already fixed nearly a year ago.


1998-10-24 (2.8.1rel.1)
-----------------------
* correct uninitialized index into id_append in makeuctb, which causes problems
  with def7_uni.tbl (analysis by LP)


> lynx2-8-1/src/chrtrans/makeuctb.c, line 654 is:

>           id_append[i+1] = '\0';

> in the context:

>     if (this_isDefaultMap == 1) {
>       *id_append = '\0';
>     } else {
>       for (i = 0, p = this_MIMEcharset;
>            *p && (i < UC_MAXLEN_ID_APPEND-1);
>            p++, i++) {
>           id_append[i+1] = isalnum(*p) ? *p : '_';
>       }
>     }
>     id_append[i+1] = '\0';
>     fprintf(stderr, " (%s).\n", id_append);

> which means that if this_isDefaultMap == 1, then "i" is not initialized.  In
> my case, "i == 256", way beyond the bounds of the array.

> The new stackguard compiler permutes memory enough to cause this to cause
> printf to segfault while dynamically loading during first invocation.

> I patched this by moving the errant assignment up into the else clause of the
> if:

> -------------------------------------------------------------------------------
> *** src/chrtrans/makeuctb.c~    Sat Sep 26 20:28:34 1998
> --- src/chrtrans/makeuctb.c     Thu Jul 22 17:05:40 1999
> ***************
> *** 651,656 ****
>             id_append[i+1] = isalnum(*p) ? *p : '_';
>         }
>       }
> -     id_append[i+1] = '\0';
>       fprintf(stderr, " (%s).\n", id_append);

> --- 651,656 ----
>             id_append[i+1] = isalnum(*p) ? *p : '_';
>         }
> +       id_append[i+1] = '\0';
>       }
>       fprintf(stderr, " (%s).\n", id_append);

> -------------------------------------------------------------------------------

> -- Perry Wagle (address@hidden)