core dump in gtkaccelgroup.c, patch attached

attached is a 2 line patch that fixes a core dump bug with GtkAccelGroup. the
function gtk_accel_group_disconnect_key (and possibly others that use
quick_accel_find) core dump when you try to disconnect an accelerator from an
empty group.

i found this bug while writting a regression test for Gtk2-Perl. i was
building up an accel group and then tearing it back down. in trying to delete
from an empty group i got a core dump.

the issue was in quick_accel_find, *count_p is not set to 0 until the last for
loop. so if any of the earlier returns happen a NULL array is returned and n
will be garbage memory. this caused the first while loop in disconnect_key to
happen and when entires[n] was accessed a core dump occured.

the fix is trivial, adding *count_p = 0 at the top of quick_accel_find. if
you're prefer i guess i could log a bug on this, but as simple/clear as it is
i didn't know if that would be necessary.


Attachment: gtkaccelgroup.patch
Description: Binary data

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]