Skip to content

Avoid crash when inserting comment with no value.

Petter Reinholdtsen requested to merge issue-13-comment-cmp-crash into master

This fixes the following issue as reported by valgrind:

==2828942== Invalid read of size 1
==2828942==    at 0x4847743: __strcmp_sse42 (vg_replace_strmem.c:927)
==2828942==    by 0x485505A: oggz_comment_cmp (oggz_comments.c:219)
==2828942==    by 0x485505A: oggz_comment_cmp (oggz_comments.c:213)
==2828942==    by 0x485B243: oggz_vector_tail_insertion_sort (oggz_vector.c:237)
==2828942==    by 0x485B243: oggz_vector_insert_p (oggz_vector.c:286)
==2828942==    by 0x4855B5F: oggz_comments_decode (oggz_comments.c:664)
==2828942==    by 0x485A86D: oggz_auto_read_comments (oggz_auto.c:1510)
==2828942==    by 0x4856E43: oggz_read_sync (oggz_read.c:456)
==2828942==    by 0x485738B: oggz_read (oggz_read.c:650)
==2828942==    by 0x10AD64: validate (oggz-validate.c:445)
==2828942==    by 0x10A431: main (oggz-validate.c:594)
==2828942==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==2828942==
==2828942==
==2828942== Process terminating with default action of signal 11 (SIGSEGV)
==2828942==  Access not within mapped region at address 0x0
==2828942==    at 0x4847743: __strcmp_sse42 (vg_replace_strmem.c:927)
==2828942==    by 0x485505A: oggz_comment_cmp (oggz_comments.c:219)
==2828942==    by 0x485505A: oggz_comment_cmp (oggz_comments.c:213)
==2828942==    by 0x485B243: oggz_vector_tail_insertion_sort (oggz_vector.c:237)
==2828942==    by 0x485B243: oggz_vector_insert_p (oggz_vector.c:286)
==2828942==    by 0x4855B5F: oggz_comments_decode (oggz_comments.c:664)
==2828942==    by 0x485A86D: oggz_auto_read_comments (oggz_auto.c:1510)
==2828942==    by 0x4856E43: oggz_read_sync (oggz_read.c:456)
==2828942==    by 0x485738B: oggz_read (oggz_read.c:650)
==2828942==    by 0x10AD64: validate (oggz-validate.c:445)
==2828942==    by 0x10A431: main (oggz-validate.c:594)

The problem is triggered when oggz_comments_decode() is calling _oggz_comment_add_byname() with NULL as its third argument. Not sure what should happen with a comment consisting only of a name and no value, but the provided patch block the crash from occuring.

Fixes #13 (closed)

Merge request reports