Bug 167701 - Fix for XmList out of bound accesses
Fix for XmList out of bound accesses
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: openmotif (Show other bugs)
4.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Thomas Woerner
:
Depends On:
Blocks: 180356 181409
  Show dependency treegraph
 
Reported: 2005-09-07 08:14 EDT by Bastien Nocera
Modified: 2007-11-30 17:07 EST (History)
1 user (show)

See Also:
Fixed In Version: RHBA-2006-0292
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-08-10 17:16:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
openmotif-list-overrun2.patch (1.72 KB, patch)
2005-09-07 08:14 EDT, Bastien Nocera
no flags Details | Diff
xmbug.c (1.73 KB, text/plain)
2005-09-07 08:16 EDT, Bastien Nocera
no flags Details
xmrotate.c (2.21 KB, text/plain)
2005-09-07 08:18 EDT, Bastien Nocera
no flags Details
New overrun patch. (1.72 KB, patch)
2006-01-30 11:45 EST, Thomas Woerner
no flags Details | Diff
openMotif-2.2.3-overrun.patch (1.72 KB, patch)
2006-02-01 12:06 EST, Thomas Woerner
no flags Details | Diff

  None (edit)
Description Bastien Nocera 2005-09-07 08:14:50 EDT
There are a number of problems in lib/Xm/List.c in openmotif, where items
outside the list would be accessed, usually causing a SEGV.

Patch attached. Testcases coming as well.
Comment 1 Bastien Nocera 2005-09-07 08:14:50 EDT
Created attachment 118552 [details]
openmotif-list-overrun2.patch
Comment 2 Bastien Nocera 2005-09-07 08:16:53 EDT
Created attachment 118553 [details]
xmbug.c

Click on one element in the list (without releasing the mouse button), then
release the button when the item has been removed from the list.
This usually causes a segfault.
Comment 3 Bastien Nocera 2005-09-07 08:18:06 EDT
Created attachment 118554 [details]
xmrotate.c

Select multiple items and extend the selection from back to top and vice-versa,
a segfault should arise soon after multiple extensions or selections.
Comment 4 Bastien Nocera 2005-09-07 08:20:54 EDT
Note that this change is on purpose. start is decreased by one when called as an
argument of SelectRange. start == 0 would cause the index in SelectRange to be -1...

@@ -4683,7 +4693,7 @@ SelectElement(Widget wid,
 	    SelectRange(lw, item, end + 1, sel);
 	  else if ((i > end) && (i <= start))
 	    RestoreRange(lw, end, i - 1, FALSE);
-	  else if (i > start)
+	  else if (i > start && start > 0)
 	    {
 	      if (sel)
 		SelectRange(lw, end, start - 1, FALSE);
Comment 7 Thomas Woerner 2006-01-30 11:45:28 EST
Created attachment 123873 [details]
New overrun patch.

Analyzing the patch and the code, I have fixed the code in a different way.
Please find attached the new patch.
Comment 8 Thomas Woerner 2006-02-01 12:06:18 EST
Created attachment 123976 [details]
openMotif-2.2.3-overrun.patch

Revised version from ICS (upstream) with an additional fix.
Comment 16 Red Hat Bugzilla 2006-08-10 17:16:46 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2006-0292.html

Note You need to log in before you can comment on or make changes to this bug.