tags 570581 patch
user [email protected]
# the following doesn't imply that we came up with the *idea* in Ubuntu,
# so I'm not trying to steal credit; that would involve an origin-ubuntu
# usertag too :-)
usertags 570581 ubuntu-patch lucid
thanks

On Fri, Feb 19, 2010 at 04:31:54PM -0500, Brad Jorsch wrote:
> Illustrative command: whiptail --yesno foo 15 77
> 
> This may be a bug in fribidi, it all depends on how fribidi_log2vis is
> supposed to work. I'm filing it here because it seems to me libnewt0.52
> is more likely to be in the wrong.

Thanks so much for analysing this!  I spent nearly a full day trying to
track this down as a possible bug in cdebconf (in d-i) before it
occurred to me that it might be reproducible with newt alone, and thus
found this in the Debian newt bug list ...

> At line 295 of newt.c, newt calls fribidi_log2vis passing the length of
> the input string (not counting the terminating 0 character) and never
> makes sure that the output buffer is actually terminated. In 0.10.9 this
> worked fine, but now with 0.19.2 you end up with random garbage after
> the button texts.
> 
> One simple fix would be to just set out[len] = 0 at line 296 to ensure
> proper string termination.

I don't have a particular opinion on the fribidi change, but my instinct
here would be to zero-fill the output array, which is a one-line change
too.  I applied the following patch to the newt package in Ubuntu:

  * Zero-initialise fribidi_log2vis' output buffer, since it no longer does
    so itself (thanks to Brad Jorsch for analysis; Debian bug #570581;
    LP: #526391).

--- newt-0.52.10.orig/debian/patches/710_fribidi_zero_initialise.patch
+++ newt-0.52.10/debian/patches/710_fribidi_zero_initialise.patch
@@ -0,0 +1,12 @@
+diff -ruN newt-0.52.10-old/newt.c newt-0.52.10/newt.c
+--- newt-0.52.10-old/newt.c    2010-02-23 20:22:23.000000000 +0000
++++ newt-0.52.10/newt.c        2010-02-23 20:24:25.000000000 +0000
+@@ -288,7 +288,7 @@
+     }
+     
+     if (need_out) {
+-        out = (FriBidiChar *)malloc(sizeof(FriBidiChar)*(len+1));
++        out = (FriBidiChar *)calloc(len+1, sizeof(FriBidiChar));
+         if(!out)
+         {
+           dlclose(handle);

Alastair, could something like this be uploaded quite urgently?  I
expect that it'll start causing confusion among d-i users quite soon.

Thanks,

-- 
Colin Watson                                       [[email protected]]



-- 
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]

Reply via email to