Le jeudi 3 août 2006 11:33, Jérôme Pouiller a écrit :
> I tried to execute valgrind on makepat (compiled without '-O2'), but,
> it found no errors.
In fact, I didn't run correctly valgrind, there is only one error with 
CFLAGS="-g":
==32258== Conditional jump or move depends on uninitialised value(s)
==32258==    at 0x4026754: getpath (iotool.c:145)
==32258==    by 0x80487C2: main (makepat.c:46)
Because strlen(JumanPath) == 0. It isn't our bug but, it'd be a good 
idea to correct it

and with CFLAGS="-O2 -g", this error appears:
==1782== Use of uninitialised value of size 4
==1782==    at 0x8048A3E: main (makepat.c:68)
makepat.c:68 match with return of main function. Surely, there is a 
buffer overflow while write in one of local variables of main function. 

So I have search an invalid acces to one these variables and it appears:
  char kugiri[1];
  [...]
  sprintf(kugiri,"\t");

"\t" use two bytes, so this instruction overwrite some data of stack and 
program do segfault.

I join patch to correct this bug:

diff -r juman-5.1.orig/build-tree/juman-5.1/makepat/makepat.c 
juman-5.1/build-tree/juman-5.1/makepat/makepat.c
32c32
<   char kugiri[1]; /* �ڤ� */
---
>   char kugiri[2]; /* �ڤ� */


-- 
Jérôme Pouiller (Jezz) <jezz AT sysmic DOT org>

Reply via email to