[Libpst-devel] _pst_read_block_size errors

[Nigel Horne]

Joseph Nahmias wrote:
>>>>In _pst_read_block_size if the number of bytes read is small (typically 0)
>>>>the software reads uninitialised values because it does things such as
>>>>read buf[0], even though no data has been read into it.
>>>
>>>
>>>I agree that this could lead to problems.
>>>
>>>
>>>>Here's the proposed fix:
>>>>
>>>>*** Olibpst.c	Wed Apr 26 13:35:51 2006
>>>>--- libpst.c	Wed Apr 26 13:37:17 2006
>>>>***************
>>>>*** 3856,3861 ****
>>>>--- 3856,3866 ----
>>>>    } else {
>>>>      DEBUG_WARN(("I can't tell why it failed\n"));
>>>>    }
>>>>+ 	if(rsize <= 2) {
>>>>+ 		fseek(pf->fp, fpos, SEEK_SET);
>>>>+ 		*buf = '\0';
>>>
>>>
>>>This seems like a memory leak to me.  We should be freeing *buf
>>>and then setting it to NULL.  Also, I would put this outside
>>>the if (rsize != size) block.  If, for whatever reason, size were 1 this
>>>would still crash.  Agreed?
>>
>>I sent a fix to my patch a couple of days ago, replacing *buf = '\0'
>>with **buf = '\0'. Did you not get it?
> 
> 
> I noticed it only after I sent this mail.  However, I still think we
> should be freeing *buf... Thoughts?

Is the calling routing expecting to free buf if the return value is 0?

-Nigel

-- 
Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, 
Typesetter.
NJH Music, Barnsley, UK.  ICQ#20252325
njh at bandsman.co.uk http://www.bandsman.co.uk
-------------- next part --------------
A non-text attachment was scrubbed...
Name: njh.vcf
Type: text/x-vcard
Size: 181 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/libpst-devel/attachments/20060428/c49e1c4e/njh.vcf