[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: 20000225: stringlist.c suggestion

David,

Thank you for finding this bug and fixing it!  We have incorporated the
change in the COMET distribution of GARP. 

Dave Himes
COMET

According to Unidata Support:
> 
> >To: address@hidden
> >cc: address@hidden
> >From: David Wojtowicz <address@hidden>
> >Subject: found/fixed garp bug
> >Organization: .
> >Keywords: 200002250700.AAA16634
> 
> Hi,
> 
>  We noticed the following bug in garp (from NAWIPS-5.4PL15)
> 
>  When bringing up the image selection dialog, the program would dump
> core in certain data directory configurations.
> 
>  I traced it to the function SplitByDelimeter() in 
>  $NAWIPS/garp/util/stringlist.c
> 
>  It allocates a fixed buffer (buf) of size 1024 bytes for string processing.
> However, it is possible to overflow that if, for example, $SAT
> is a long path and there are lots of image subdirectories.  This was
> the case in our situation.
> 
>  I propose the following patch (below) to dynamically allocate
> a buffer of the exact size needed.  Adds a bit of overhead but
> I don't think SplitByDelimeter is called inside any time critical
> loops.  Alternately, the fixed buffer could be made larger, but then
> how large is enough?
> 
> 
> 
> ---8<---- stringlist.patch ------------------------------------------------
> *** garp/util/stringlist.c      Fri Feb 25 06:42:17 2000
> --- garp/util/stringlist.c.new  Fri Feb 25 06:41:48 2000
> ***************
> *** 244,250 ****
>    * of parsed strings.
>    */
>   {
> !       char            buf[1024], *token;
>         char            **tList;
>         int             i, count=1;
>         int             verbose;
> --- 244,250 ----
>    * of parsed strings.
>    */
>   {
> !       char            *buf, *token;
>         char            **tList;
>         int             i, count=1;
>         int             verbose;
> ***************
> *** 272,277 ****
> --- 272,278 ----
>    *    case when the first token is null. Replace NULL substrings with
>    *    a space.
>    */
> +         buf = malloc (strlen(input) + 2);
>         if ( strncmp ( input, delimeter, 1 ) == 0 ) {
>             strcpy ( buf, " " );
>             strcat ( buf, input );
> ***************
> *** 288,293 ****
> --- 289,295 ----
>                tList[i] = strdup ( " " );
>             token = strtok ( NULL, delimeter );
>         }
> +         free(buf);
> 
>   /*
>    *    Return values.
> ---->8-----------------------------------------------------------------------
> 
> 
> --------------------------------------------------------
>  David Wojtowicz, Research Programmer
>  Department of Atmospheric Sciences Computer Services
>  University of Illinois at Urbana-Champaign
>  email: address@hidden  phone: (217)333-8390
> --------------------------------------------------------
> 
> 
> ------- End of Forwarded Message
> 
> 


-- 

Dave