Re: [g-a-devel]Re: patch for at-spi/libspi/stateset.c

[Bill Haneman <bill haneman sun com>]

On Sat, 2002-04-27 at 00:01, Radek Doulík wrote:
> 
> There is an updated version which fixes default value setting as well.
> 
> Cheers
> Radek

Hi Radek:

Thanks for the patch.

I don't believe it's quite correct however; you are for instance
creating an array of objects of type atk_state_type but of length
Accessibility_STATE_LAST_DEFINED, and the two state enums are (as you
see) not equivalent. 

Similarly you create an array of Accessibility_StateType values, but of
length ATK_STATE_LAST_DEFINED. I think this is not exactly what you
meant to do here ;-)

I believe the attached patch will work better.  It looks as though the
original bug was the result of a bad merge, since the arrays were being
allocated twice.

Best regards,

-Bill

> On Pá, 2002-04-26 at 14:02, Radek Doulík wrote:
> > 
> > Hi,
> > 
> > please find attached patch which fixes nasty out of bounds memory access
> > in at-spi/libspi/stateset.c.
> > 
> > Cheers
> > Radek
> 
> ----
> 

> ? .debug
> ? diff
> ? registryd/at-spi-registryd
> Index: ChangeLog
> ===================================================================
> RCS file: /cvs/gnome/at-spi/ChangeLog,v
> retrieving revision 1.194
> diff -u -p -r1.194 ChangeLog
> --- ChangeLog	22 Apr 2002 18:29:05 -0000	1.194
> +++ ChangeLog	26 Apr 2002 23:56:56 -0000
> @@ -1,3 +1,8 @@
> +2002-04-26  Radek Doulik  <rodo ximian com>
> +
> +	* libspi/stateset.c (spi_init_state_type_tables): fix size of
> +	atk_state_types table
> +
>  2002-04-22  jacob berkman  <jacob ximian com>
>  
>  	* util/Makefile.am: 
> Index: libspi/stateset.c
> ===================================================================
> RCS file: /cvs/gnome/at-spi/libspi/stateset.c,v
> retrieving revision 1.3
> diff -u -p -r1.3 stateset.c
> --- libspi/stateset.c	13 Apr 2002 20:47:46 -0000	1.3
> +++ libspi/stateset.c	26 Apr 2002 23:56:56 -0000
> @@ -46,12 +46,15 @@ spi_init_state_type_tables (void)
>    g_return_val_if_fail (atk_state_types, FALSE);
>    
>    accessible_state_types = g_new (Accessibility_StateType, ATK_STATE_LAST_DEFINED);
> -  atk_state_types = g_new (AtkStateType, ATK_STATE_LAST_DEFINED);
> -
>    for (i = 0; i < ATK_STATE_LAST_DEFINED; i++)
>      {
> -      atk_state_types[i] = ATK_STATE_INVALID;
>        accessible_state_types[i] = Accessibility_STATE_INVALID;
> +    }
> +
> +  atk_state_types = g_new (AtkStateType, Accessibility_STATE_LAST_DEFINED);
> +  for (i = 0; i < Accessibility_STATE_LAST_DEFINED; i++)
> +    {
> +      atk_state_types[i] = ATK_STATE_INVALID;
>      }
>  
>    accessible_state_types[ATK_STATE_ACTIVE] = Accessibility_STATE_ACTIVE;

Index: libspi/stateset.c
===================================================================
RCS file: /cvs/gnome/at-spi/libspi/stateset.c,v
retrieving revision 1.3
diff -u -r1.3 stateset.c
--- libspi/stateset.c	13 Apr 2002 20:47:46 -0000	1.3
+++ libspi/stateset.c	29 Apr 2002 11:44:35 -0000
@@ -45,13 +45,14 @@
   g_return_val_if_fail (accessible_state_types, FALSE);
   g_return_val_if_fail (atk_state_types, FALSE);
   
-  accessible_state_types = g_new (Accessibility_StateType, ATK_STATE_LAST_DEFINED);
-  atk_state_types = g_new (AtkStateType, ATK_STATE_LAST_DEFINED);
-
   for (i = 0; i < ATK_STATE_LAST_DEFINED; i++)
     {
       atk_state_types[i] = ATK_STATE_INVALID;
-      accessible_state_types[i] = Accessibility_STATE_INVALID;
+    }
+
+  for (i=0; i < Accessibility_STATE_LAST_DEFINED; i++)
+    {
+      accessible_state_types[i] = Accessibility_STATE_INVALID;	
     }
 
   accessible_state_types[ATK_STATE_ACTIVE] = Accessibility_STATE_ACTIVE;