[argyllcms] dispwin - bad command line option makes dispwin segfault

  • From: Jörg Frings-Fürst <debian@xxxxxxxxxxxxxxxxxx>
  • To: argyllcms@xxxxxxxxxxxxx
  • Date: Wed, 10 Sep 2014 16:07:49 +0200

Hello,

in Debian we have the bug[1].

If dispwin is started with "dispwin -d" it runs into a segfault.

The output of gdb is

####
(gdb) file dispwin
Reading symbols from dispwin...Reading symbols
from 
/usr/lib/debug/.build-id/0c/5af1737443a64c21ca2a3eca93df00da9a623c.debug...done.
done.
(gdb) run -d
Starting program: /usr/bin/dispwin -d
[Thread debugging using libthread_db enabled]
Using host libthread_db library
"/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x000000000040595d in main (argc=2, argv=0x7fffffffdf18) at
spectro/dispwin.c:5496
5496                                    if (strncmp(na,"web",3) == 0
(gdb) 
####

na is NULL at this point.

I have added the line

if(na == NULL)  usage("-d parameter missing"); 

before. The patch file is attached.


CU
Jörg


-- 
pgp Fingerprint: 7D13 3C60 0A10 DBE1 51F8  EBCB 422B 44B0 BE58 1B6E
pgp Key: BE581B6E
CAcert Key S/N: 0E:D4:56

Jörg Frings-Fürst
D-54526 Niederkail

Threema: SYR8SJXB

IRC: j_f-f@xxxxxxxxxxxx
     j_f-f@xxxxxxxx





Description: Add check for NULL pointer
Author: Jörg Frings-Fürst <debian@xxxxxxxxxxxxxxxxxx>
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700253
Forwarded: Yes, to ML
Reviewed-by: 
Last-Update: 2014-09-10
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
Index: trunk/spectro/dispwin.c
===================================================================
--- trunk.orig/spectro/dispwin.c        2014-09-10 16:05:36.633175564 +0200
+++ trunk/spectro/dispwin.c     2014-09-10 16:06:16.781967935 +0200
@@ -5493,6 +5493,7 @@
 
                        /* Display number */
                        else if (argv[fa][1] == 'd') {
+                               if(na == NULL)  usage("-d parameter missing");
                                if (strncmp(na,"web",3) == 0
                                 || strncmp(na,"WEB",3) == 0) {
                                        webdisp = 8080;

Attachment: signature.asc
Description: This is a digitally signed message part

Other related posts: