Bug#346348: Fwd: Bug#346348: txt2pdbdoc core dump when compress chinese document

2006-01-19 Thread Erik Schanze
Hi Paul,

Paul J. Lucas "Paul J. Lucas" <[EMAIL PROTECTED]>:
>   I'm not the original author of the code, so I don't understand
>   the compression algorithm very well, so I'm not inclined to make
>   a hack fix without knowing the real problem.
>
I think put_byte() in txt2pdbdoc.c is problematic.

NEWBUFFER() allocated a buffer of BUFFERSIZE (6000) bytes and put_byte() 
put up to RECORD_SIZE_MAX (4096) characters into.

But if there are characters > 0x80, then a '\1' will be prepended. If 
all characters will be > 0x80, we will need  
BUFFERSIZE = RECORD_SIZE_MAX * 2.

I have attached the change as a patch, please proove it and consider to 
apply it.

There are additional patches of previous bugs, perhaps you are 
interested.

A new Debian package is prepared and wait for upload.


Kindly regards,
Erik


-- 
 www.ErikSchanze.de *
 Bitte keine HTML-E-Mails! No HTML mails, please! Limit: 100 kB *
 - Chemnitzer Linux-Tage am 4. und 5. März 2006 *
 Info: http://chemnitzer.linux-tage.de/ *
--- txt2pdbdoc-1.4.4.orig/configure
+++ txt2pdbdoc-1.4.4/configure
@@ -1210,7 +1210,7 @@
 
 # Define the identity of the package.
  PACKAGE=txt2pdbdoc
- VERSION=1.4.3
+ VERSION=1.4.4
 
 cat >>confdefs.h <--- txt2pdbdoc-1.4.4.orig/html2pdbtxt.1
+++ txt2pdbdoc-1.4.4/html2pdbtxt.1
@@ -36,7 +36,7 @@
 ..
 .\" ---
 .tr ~
-.TH \f3html2pdbtxt\fP 1 "June 15, 2001" "html2pdbtxt"
+.TH \f3html2pdbtxt\fP 1 "January 21, 2005" "html2pdbtxt"
 .SH NAME
 html2pdbtxt \- HTML to Doc Text converter for Palm Pilots
 .SH SYNOPSIS
@@ -129,7 +129,7 @@
 To convert an HTML file to Doc:
 .cS
 html2pdbtxt -u http://www.wonderland.org/ alice.html alice.txt
-txt2pdbdoc `head -1 alice.txt` alice.txt alice.pdb
+txt2pdbdoc "`head -1 alice.txt`" alice.txt alice.pdb
 .cE
 .SH CAVEATS
 .TP 4
@@ -151,9 +151,7 @@
 since it would have to be parsed
 rather than simple substitutions being performed.
 .SH SEE ALSO
-.BR pdbtxt2html (1),
-.BR txt2pdbdoc (1),
-.BR doc (4)
+pdbtxt2html(1), txt2pdbdoc(1), doc(4), pdb(4)
 .PP
 International Standards Organization.
 ``ISO 8859-1: Information Processing
--- txt2pdbdoc-1.4.4.orig/txt2pdbdoc.c
+++ txt2pdbdoc-1.4.4/txt2pdbdoc.c
@@ -46,7 +46,7 @@
 #define	true		1
 
 /* constants */
-#define	BUFFER_SIZE	6000		/* big enough for uncompressed record */
+#define	BUFFER_SIZE	(RECORD_SIZE_MAX * 2) /* big enough for uncompressed record */
 #define	COMPRESSED	2
 #define	COUNT_BITS	3		/* why this value?  I don't know */
 #define	DISP_BITS	11		/* ditto */


Bug#346348: Fwd: Bug#346348: txt2pdbdoc core dump when compress chinese document

2006-01-18 Thread Paul J. Lucas
I never claimed the software would work or is supposed to work
for Chinese characters.  I've been corresponding with this guy
and I told him the same thing.

I'm not the original author of the code, so I don't understand
the compression algorithm very well, so I'm not inclined to make
a hack fix without knowing the real problem.

- Paul

On Wed, 18 Jan 2006, Erik Schanze wrote:

> Dear Paul,
> 
> [ Please keep Debian-BTS in CC line. ]
> 
> a Debian user of txt2pdbdoc has reported a bug on converting chinese 
> documents.
> (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346348)
> 
> I can confirm the bug with his test file on my side. Please test it and 
> give us your opinion.
> 
> URL to test file:
> http://bugs.debian.org/cgi-bin/bugreport.cgi/gbk.txt?bug=346348;msg=20;att=1
> 
> Thank you in advance.
> 
> ------  Forwarded Message  ------
> 
> Subject: Bug#346348: txt2pdbdoc core dump when compress chinese document
> Date: Sonntag, 8. Januar 2006 09:06
> From: Xie Yanbo <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> 
> On 1/8/06, Erik Schanze <[EMAIL PROTECTED]> wrote:
> > Please provide some sample data for testing. (No private material!)
> > A backtrace of gdb would also be nice, if you are able to do so.
> 
> I got this backgrace running with attachment file `gbk.txt'.
> 
> 0$ echo $LANG
> C
> 0$ export LANG=C
> 0$ ./txt2pdbdoc test gbk.txt gbk.pdb
> *** glibc detected *** double free or corruption (out): 0x0804da50 ***
> Aborted (core dumped)
> 134$ gdb ./txt2pdbdoc ./core
> GNU gdb 6.4-debian
> Copyright 2005 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and
>  you are welcome to change it and/or distribute copies of it under
>  certain conditions. Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for
>  details. This GDB was configured as "i486-linux-gnu"...Using host
>  libthread_db library "/lib/tls/libthread_db.so.1".
> 
> Core was generated by `./txt2pdbdoc test gbk.txt gbk.pdb'.
> Program terminated with signal 6, Aborted.
> 
> warning: Can't read pathname for load map: Input/output error.
> Reading symbols from /lib/tls/libc.so.6...done.
> Loaded symbols for /lib/tls/libc.so.6
> Reading symbols from /lib/ld-linux.so.2...done.
> Loaded symbols for /lib/ld-linux.so.2
> #0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
> (gdb) bt
> #0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
> #1  0xb7e3c04b in abort () from /lib/tls/libc.so.6
> #2  0xb7e71015 in __fsetlocking () from /lib/tls/libc.so.6
> #3  0xb7e77667 in malloc_usable_size () from /lib/tls/libc.so.6
> #4  0xb7e77b02 in free () from /lib/tls/libc.so.6
> #5  0x08048cfb in compress (b=0xbfe6c11c) at txt2pdbdoc.c:306
> #6  0x0804950b in encode (document_name=0xbfe6d8f6 "test",
> src_file_name=0x0, dest_file_name=0x0) at txt2pdbdoc.c:561
> #7  0x08049b3f in main (argc=3, argv=0xbfe6c204) at txt2pdbdoc.c:217
> (gdb) frame
> #0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
> (gdb) l txt2pdbdoc.c:306
> 301 /* when we get to the end of the buffer, don't
> inc past the */
> 302 /* end; this forces the residue chars out one
> at a time */
> 303 if ( tail != end )
> 304 ++tail;
> 305 }
> 306 free( buf_orig );
> 307
> 308 if ( space )
> 309 b->data[ b->len++ ] = ' ';  /* add
> left-over space */
> 310
> (gdb)
> 0$
> 
> And compress utf8 file will be ok.
> 
> 0$ cat gbk.txt | iconv -f gbk -t utf8 > utf8.txt
> 0$ ./txt2pdbdoc test utf8.txt utf8.pdb
> 
> These can explain what happens:
> 
> 0$ gdb ./txt2pdbdoc
> (gdb) b txt2pdbdoc.c:306
> Breakpoint 1 at 0x8048cf0: file txt2pdbdoc.c, line 306.
> (gdb) b txt2pdbdoc.c:561
> Breakpoint 2 at 0x8049500: file txt2pdbdoc.c, line 561.
> (gdb) r test gbk.txt gbk.pdb
> Starting program: /home/xyb/deb/txt2pdbdoc/txt2pdbdoc-1.4.4/txt2pdbdoc
> test gbk.txt gbk.pdb
> 
> Breakpoint 2, encode (document_name=0xbfab38ca "test",
> src_file_name=0x1 ,
> dest_file_name=0x1 ) at txt2pdbdoc.c:561
> 561 compress( &buf );
> (gdb) p buf.len
> $1 = 4004
> (gdb) c
> Continuing.
> 
> Breakpoint 1, compress (b=0xbfab1a0c) at txt2pdbdoc.c:306
> 306 free( buf_orig );
> (gdb) p b.len
> $2 = 6034
> (gdb) s
> *** glibc detected *** double free or corruption (out): 0x0804da50 ***
> 
> Program

Bug#346348: Fwd: Bug#346348: txt2pdbdoc core dump when compress chinese document

2006-01-18 Thread Erik Schanze
Dear Paul,

[ Please keep Debian-BTS in CC line. ]

a Debian user of txt2pdbdoc has reported a bug on converting chinese 
documents.
(http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346348)

I can confirm the bug with his test file on my side. Please test it and 
give us your opinion.

URL to test file:
http://bugs.debian.org/cgi-bin/bugreport.cgi/gbk.txt?bug=346348;msg=20;att=1

Thank you in advance.

--  Forwarded Message  --

Subject: Bug#346348: txt2pdbdoc core dump when compress chinese document
Date: Sonntag, 8. Januar 2006 09:06
From: Xie Yanbo <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]

On 1/8/06, Erik Schanze <[EMAIL PROTECTED]> wrote:
> Please provide some sample data for testing. (No private material!)
> A backtrace of gdb would also be nice, if you are able to do so.

I got this backgrace running with attachment file `gbk.txt'.

0$ echo $LANG
C
0$ export LANG=C
0$ ./txt2pdbdoc test gbk.txt gbk.pdb
*** glibc detected *** double free or corruption (out): 0x0804da50 ***
Aborted (core dumped)
134$ gdb ./txt2pdbdoc ./core
GNU gdb 6.4-debian
Copyright 2005 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and
 you are welcome to change it and/or distribute copies of it under
 certain conditions. Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
 details. This GDB was configured as "i486-linux-gnu"...Using host
 libthread_db library "/lib/tls/libthread_db.so.1".

Core was generated by `./txt2pdbdoc test gbk.txt gbk.pdb'.
Program terminated with signal 6, Aborted.

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/tls/libc.so.6...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
(gdb) bt
#0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
#1  0xb7e3c04b in abort () from /lib/tls/libc.so.6
#2  0xb7e71015 in __fsetlocking () from /lib/tls/libc.so.6
#3  0xb7e77667 in malloc_usable_size () from /lib/tls/libc.so.6
#4  0xb7e77b02 in free () from /lib/tls/libc.so.6
#5  0x08048cfb in compress (b=0xbfe6c11c) at txt2pdbdoc.c:306
#6  0x0804950b in encode (document_name=0xbfe6d8f6 "test",
src_file_name=0x0, dest_file_name=0x0) at txt2pdbdoc.c:561
#7  0x08049b3f in main (argc=3, argv=0xbfe6c204) at txt2pdbdoc.c:217
(gdb) frame
#0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
(gdb) l txt2pdbdoc.c:306
301 /* when we get to the end of the buffer, don't
inc past the */
302 /* end; this forces the residue chars out one
at a time */
303 if ( tail != end )
304 ++tail;
305 }
306 free( buf_orig );
307
308 if ( space )
309 b->data[ b->len++ ] = ' ';  /* add
left-over space */
310
(gdb)
0$

And compress utf8 file will be ok.

0$ cat gbk.txt | iconv -f gbk -t utf8 > utf8.txt
0$ ./txt2pdbdoc test utf8.txt utf8.pdb

These can explain what happens:

0$ gdb ./txt2pdbdoc
(gdb) b txt2pdbdoc.c:306
Breakpoint 1 at 0x8048cf0: file txt2pdbdoc.c, line 306.
(gdb) b txt2pdbdoc.c:561
Breakpoint 2 at 0x8049500: file txt2pdbdoc.c, line 561.
(gdb) r test gbk.txt gbk.pdb
Starting program: /home/xyb/deb/txt2pdbdoc/txt2pdbdoc-1.4.4/txt2pdbdoc
test gbk.txt gbk.pdb

Breakpoint 2, encode (document_name=0xbfab38ca "test",
src_file_name=0x1 ,
dest_file_name=0x1 ) at txt2pdbdoc.c:561
561 compress( &buf );
(gdb) p buf.len
$1 = 4004
(gdb) c
Continuing.

Breakpoint 1, compress (b=0xbfab1a0c) at txt2pdbdoc.c:306
306 free( buf_orig );
(gdb) p b.len
$2 = 6034
(gdb) s
*** glibc detected *** double free or corruption (out): 0x0804da50 ***

Program received signal SIGABRT, Aborted.
0xb7e807a7 in raise () from /lib/tls/libc.so.6
(gdb) c
Continuing.

Program terminated with signal SIGABRT, Aborted.
The program no longer exists.
(gdb) q
0$
0$ gdb ./txt2pdbdoc
(gdb) b txt2pdbdoc.c:306
Breakpoint 1 at 0x8048cf0: file txt2pdbdoc.c, line 306.
(gdb) b txt2pdbdoc.c:561
Breakpoint 2 at 0x8049500: file txt2pdbdoc.c, line 561.
(gdb) r test utf8.txt utf8.pdb
Starting program: /home/xyb/deb/txt2pdbdoc/txt2pdbdoc-1.4.4/txt2pdbdoc
test utf8.txt utf8.pdb

Breakpoint 2, encode (document_name=0xbfe518c8 "test",
src_file_name=0x1 ,
dest_file_name=0x1 ) at txt2pdbdoc.c:561
561 compress( &buf );
(gdb) p buf.len
$1 = 4096
(gdb) c
Continuing.

Breakpoint 1, compress (b=0xbfe4ff7c) at txt2pdbdoc.c:306
306 free( buf_orig );
(gdb) p b.len
$2 = 4351
(gdb) c
Continuing.

Breakpoint 2, encode (document_name=0xbfe518c8 "test",
src_file_name=0x1 ,
dest_file_name=0x1 ) at txt2pdbdoc.c:561
561   

Bug#346348: txt2pdbdoc core dump when compress chinese document

2006-01-08 Thread Xie Yanbo
On 1/8/06, Erik Schanze <[EMAIL PROTECTED]> wrote:
> Please provide some sample data for testing. (No private material!)
> A backtrace of gdb would also be nice, if you are able to do so.

I got this backgrace running with attachment file `gbk.txt'.

0$ echo $LANG
C
0$ export LANG=C
0$ ./txt2pdbdoc test gbk.txt gbk.pdb
*** glibc detected *** double free or corruption (out): 0x0804da50 ***
Aborted (core dumped)
134$ gdb ./txt2pdbdoc ./core
GNU gdb 6.4-debian
Copyright 2005 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...Using host libthread_db
library "/lib/tls/libthread_db.so.1".

Core was generated by `./txt2pdbdoc test gbk.txt gbk.pdb'.
Program terminated with signal 6, Aborted.

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/tls/libc.so.6...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
(gdb) bt
#0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
#1  0xb7e3c04b in abort () from /lib/tls/libc.so.6
#2  0xb7e71015 in __fsetlocking () from /lib/tls/libc.so.6
#3  0xb7e77667 in malloc_usable_size () from /lib/tls/libc.so.6
#4  0xb7e77b02 in free () from /lib/tls/libc.so.6
#5  0x08048cfb in compress (b=0xbfe6c11c) at txt2pdbdoc.c:306
#6  0x0804950b in encode (document_name=0xbfe6d8f6 "test",
src_file_name=0x0, dest_file_name=0x0) at txt2pdbdoc.c:561
#7  0x08049b3f in main (argc=3, argv=0xbfe6c204) at txt2pdbdoc.c:217
(gdb) frame
#0  0xb7e3a7a7 in raise () from /lib/tls/libc.so.6
(gdb) l txt2pdbdoc.c:306
301 /* when we get to the end of the buffer, don't
inc past the */
302 /* end; this forces the residue chars out one
at a time */
303 if ( tail != end )
304 ++tail;
305 }
306 free( buf_orig );
307
308 if ( space )
309 b->data[ b->len++ ] = ' ';  /* add
left-over space */
310
(gdb)
0$

And compress utf8 file will be ok.

0$ cat gbk.txt | iconv -f gbk -t utf8 > utf8.txt
0$ ./txt2pdbdoc test utf8.txt utf8.pdb

These can explain what happens:

0$ gdb ./txt2pdbdoc
(gdb) b txt2pdbdoc.c:306
Breakpoint 1 at 0x8048cf0: file txt2pdbdoc.c, line 306.
(gdb) b txt2pdbdoc.c:561
Breakpoint 2 at 0x8049500: file txt2pdbdoc.c, line 561.
(gdb) r test gbk.txt gbk.pdb
Starting program: /home/xyb/deb/txt2pdbdoc/txt2pdbdoc-1.4.4/txt2pdbdoc
test gbk.txt gbk.pdb

Breakpoint 2, encode (document_name=0xbfab38ca "test",
src_file_name=0x1 ,
dest_file_name=0x1 ) at txt2pdbdoc.c:561
561 compress( &buf );
(gdb) p buf.len
$1 = 4004
(gdb) c
Continuing.

Breakpoint 1, compress (b=0xbfab1a0c) at txt2pdbdoc.c:306
306 free( buf_orig );
(gdb) p b.len
$2 = 6034
(gdb) s
*** glibc detected *** double free or corruption (out): 0x0804da50 ***

Program received signal SIGABRT, Aborted.
0xb7e807a7 in raise () from /lib/tls/libc.so.6
(gdb) c
Continuing.

Program terminated with signal SIGABRT, Aborted.
The program no longer exists.
(gdb) q
0$
0$ gdb ./txt2pdbdoc
(gdb) b txt2pdbdoc.c:306
Breakpoint 1 at 0x8048cf0: file txt2pdbdoc.c, line 306.
(gdb) b txt2pdbdoc.c:561
Breakpoint 2 at 0x8049500: file txt2pdbdoc.c, line 561.
(gdb) r test utf8.txt utf8.pdb
Starting program: /home/xyb/deb/txt2pdbdoc/txt2pdbdoc-1.4.4/txt2pdbdoc
test utf8.txt utf8.pdb

Breakpoint 2, encode (document_name=0xbfe518c8 "test",
src_file_name=0x1 ,
dest_file_name=0x1 ) at txt2pdbdoc.c:561
561 compress( &buf );
(gdb) p buf.len
$1 = 4096
(gdb) c
Continuing.

Breakpoint 1, compress (b=0xbfe4ff7c) at txt2pdbdoc.c:306
306 free( buf_orig );
(gdb) p b.len
$2 = 4351
(gdb) c
Continuing.

Breakpoint 2, encode (document_name=0xbfe518c8 "test",
src_file_name=0x1 ,
dest_file_name=0x1 ) at txt2pdbdoc.c:561
561 compress( &buf );
(gdb) p buf.len
$3 = 1872
(gdb) c
Continuing.

Breakpoint 1, compress (b=0xbfe4ff7c) at txt2pdbdoc.c:306
306 free( buf_orig );
(gdb) p b.len
$4 = 2256
(gdb) c
Continuing.

Program exited normally.
(gdb) q
0$
´óÃ÷³É×æ»ÊµÛÓÀÀÖÁùÄê°ËÔÂÒÒ䣬Î÷ÄϺ£Íâ²³Äà¹ú¹úÍõÂéÄÇÈǼÓÄÇÄË£¬ÂÊͬåú×Ó¡¢µÜ¡¢ 
Ãá¢ÊÀ×Ó¼°Åã³¼À´³¯£¬½ø¹±ÁúÄÔ¡¢º×¶¥¡¢çé裡¢Ï¬½Ç¡¢½ðÒø±¦Æ÷µÈÖî°ãÎïÊ¡£³É×æ»ÊµÛ´óÔÃ
 £¬¼ÎÀÍÁ¼¾Ã£¬´ÍÑç·îÌìÃÅ¡£

ÄÇØÃÄà¹ú¼´½ñÆÅÂÞÖÞ±±²¿µÄÆÅÂÞÄË£¬ÓÖ³ÆÎÄÀ³£¨²³Äà¡¢ÆÅÂÞÄË¡¢ÎÄÀ³ÒÔ¼°Ó¢ÓïBrunei¾ù 
ϵͬһµØÃûÖ®ÒôÒ룩£¬ËäºÍÖÐÍÁÏà¸ôº£³ÌÍòÀµ«ÏòÀ´ÑöĽÖлª¡£Ëγ¯Ì«Æ½Ð˹ú¶þÄ꣬ÆäÍõ
 
Ïò´ò£¨¼´ËÕµ¤£¬ÖйúÊ·ÊéÉÏÒëΪ¡°Ïò´ò¡±£©ÔøDzʹÀ´³¯£¬½ø¹±ÁúÄÔ¡¢ÏóÑÀ¡¢Ì´ÏãµÈÎÆäºó
 ³¯¹±²»¾ø¡£

ÂéÄÇÈǼÓÄÇÄ˹úÍõÑÛ¼ûÌ쳯ÉϹúÃñ·áÎ︷£¬ÎÄÖν̻¯¡¢Ò¹ÚÆ÷¾ß£¬ÎÞ²»ÁîËû»¶Ï²ÔÞ̾£¬ 
Ã÷µÛÓÖÏà´ýÉõºñ£¬¾¹

Bug#346348: txt2pdbdoc core dump when compress chinese document

2006-01-07 Thread Xie Yanbo
On 1/8/06, Erik Schanze <[EMAIL PROTECTED]> wrote:
> I wonder how a chinese document as txt file looked like. I know ASCII
> and extended ASCII (e. g. for german umlauts).
> Are you talking about UTF8 coded txt file?

The bug happened on my GBK document only. And I had tried on
the same file with UTF-8 encoding, nothing happend.

> Please provide some sample data for testing. (No private material!)
> A backtrace of gdb would also be nice, if you are able to do so.
>
> Your patch may work, but I'd like to investigate it further.

OK, I will show a test case a moment later.


Bug#346348: txt2pdbdoc core dump when compress chinese document

2006-01-07 Thread Erik Schanze
Hi Xie,

Xie Yanbo Xie Yanbo <[EMAIL PROTECTED]>:
> Package: txt2pdbdoc
> Version: 1.4.4-4
> Severity: normal
> Tags: patch
>
> *** Please type your report below this line ***
> txt2pdbdoc will core dump when compress chinese document. Function
> compress got bigger output then input data, so buffer overflowed.
> Double the compress data buffer size can fix this bug.
>
Thank you for your report.

I wonder how a chinese document as txt file looked like. I know ASCII 
and extended ASCII (e. g. for german umlauts).
Are you talking about UTF8 coded txt file?

Please provide some sample data for testing. (No private material!)
A backtrace of gdb would also be nice, if you are able to do so.

Your patch may work, but I'd like to investigate it further.


Thank you in advance.


Kindly regards,

Erik


-- 
 www.ErikSchanze.de *
 Bitte keine HTML-E-Mails! No HTML mails, please! Limit: 100 kB *
 - Chemnitzer Linux-Tage am 4. und 5. März 2006 *
 Info: http://chemnitzer.linux-tage.de/ *



Bug#346348: txt2pdbdoc core dump when compress chinese document

2006-01-07 Thread Xie Yanbo
Package: txt2pdbdoc
Version: 1.4.4-4
Severity: normal
Tags: patch

*** Please type your report below this line ***
txt2pdbdoc will core dump when compress chinese document. Function
compress got bigger output then input data, so buffer overflowed.
Double the compress data buffer size can fix this bug.

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14-2-686
Locale: LANG=zh_CN.GBK, LC_CTYPE=zh_CN.GBK (charmap=locale: Cannot set
LC_CTYPE to default locale: No such file or directorylocale: Cannot
set LC_MESSAGES to default locale: No such file or directory
locale: Cannot set LC_ALL to default locale: No such file or directory
ANSI_X3.4-1968)

Versions of packages txt2pdbdoc depends on:
ii  libc6 2.3.5-11   GNU C Library: Shared libraries an
ii  perl  5.8.7-10   Larry Wall's Practical Extraction

txt2pdbdoc recommends no packages.

-- debconf information excluded
--- txt2pdbdoc.c.orig	2003-12-04 13:21:45.0 +0800
+++ txt2pdbdoc.c	2006-01-07 15:06:01.0 +0800
@@ -67,7 +67,7 @@
 };
 
 /* macros */
-#define	NEW_BUFFER(b)	(b)->data = malloc( (b)->len = BUFFER_SIZE )
+#define	NEW_BUFFER(b)	(b)->data = malloc( (b)->len = BUFFER_SIZE*2 )
 
 #define	GET_Word(f,n) \
 	{ if ( fread( &n, 2, 1, f ) != 1 ) read_error(); n = ntohs(n); }