Opened 9 years ago

Closed 9 years ago

#5596 closed bug (fixed)

BMessage::PrintToStream() can crash

Reported by: jackburton Owned by: mmlr
Priority: normal Milestone: R1
Component: Kits/Application Kit Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Has a Patch: no Platform: All

Description (last modified by jackburton)

This can be reproduced by adding a string, an int32 and an int8 (in that order) to a BMessage and then calling PrintToStream().

Attachments (1)

backtrace.png (117.4 KB) - added by jackburton 9 years ago.

Download all attachments as: .zip

Change History (7)

Changed 9 years ago by jackburton

Attachment: backtrace.png added

comment:1 Changed 9 years ago by stippi

I think I've fixed a similar bug recently. It should probably use the field data length instead of letting vprintf figure out the length, if something is not terminated.

comment:2 Changed 9 years ago by jackburton

The culprit seems to be the following code in BMessage::_PrintToStream()

case B_STRING_TYPE:
  printf("string(\"%.*s\", %ld bytes)\n", (int)size,
     (char *)pointer, (long)size);
  break;

Which is already correct, though: it uses the passed size to print the string. Maybe something becomes corrupt.

comment:3 in reply to:  2 Changed 9 years ago by jackburton

Replying to jackburton:

Which is already correct, though: it uses the passed size to print the string. Maybe something becomes corrupt.

Reproducible with the following test case:

Add a string, an int32 and an int8 (in that order) to a BMessage and call PrintToStream().

comment:4 Changed 9 years ago by jackburton

Description: modified (diff)
Summary: calling BMessage::PrintToStream() on an archived BPicture causes a crashBMessage::PrintToStream() can crash

comment:5 Changed 9 years ago by stippi

Owner: changed from axeld to mmlr
Status: newassigned

The code you posted is the bugfix I added.

comment:6 Changed 9 years ago by jackburton

Resolution: fixed
Status: assignedclosed

It's fixed in hrev35911.

Note: See TracTickets for help on using tickets.