Re: [patch] serious problem in pango_layout_set_text()

[Sven Neumann <sven gimp org>]

Hi,

Owen Taylor <otaylor redhat com> writes:

> void
> pango_layout_set_text (PangoLayout *layout,
> 		       const char  *text,
> 		       int          length)
> {
>   const gchar *end;
>   
>   g_return_if_fail (layout != NULL);
>   g_return_if_fail (length == 0 || text != NULL);

you allow text == NULL && length == 0 here and this used to work before
and cleared the layout. 

>   if (!g_utf8_validate (text, length, &end))
>     g_warning ("Invalid UTF8 string passed to pango_layout_set_text()");

g_utf8_validate() does not like text == NULL however and will return FALSE
with a warning. 

>   length = end - text;

here you use the undefined value of end which has never been touched by
g_utf8_validate() ...

>   layout->text = g_malloc (length + 1);

... which leads to a fatal crash here unless you are unlucky or have lots
of RAM.

Not sure how this would be fixed best...


Salut, Sven