bug+fix: makeinfo: bad memory allocation in makeinfo.c::cm_image

[Vladimir Tsichevski]

Hi,

just found how to fix an annoying bug in makeinfo

the offending line was:

@image{main-frame-empty,10cm,,,png}

The bug explanation:

too little bytes allocated to accomodate name + dot + extension + 
trailing zero

The fix:

bash-3.00$ diff -u makeinfo.c.orig makeinfo.c
--- makeinfo.c.orig     2007-05-28 12:51:17.000000000 +0400
+++ makeinfo.c  2007-05-28 12:51:35.000000000 +0400
@@ -3262,7 +3262,7 @@
       struct stat file_info;
       char *pathname = NULL;
       char *fullname = xmalloc (strlen (name_arg)
-                       + (ext_arg && *ext_arg ? strlen (ext_arg) + 1: 
4) + 1);
+                       + (ext_arg && *ext_arg ? strlen (ext_arg) + 1: 
4) + 2);

       if (ext_arg && *ext_arg)
         {

The texinfo version was: 4.8a, the latest stable. IMHO, the CVS version 
should suffer from same bug too.

the problem has been reproduced on any Linux system for about two last 
years, the trace looks like the following:

*** glibc detected *** ./makeinfo: free(): invalid pointer: 0x080a33a8 ***
======= Backtrace: =========
/lib/libc.so.6[0x1741e0]
/lib/libc.so.6(__libc_free+0x77)[0x17472b]
./makeinfo[0x805ae51]
./makeinfo[0x805a307]
./makeinfo[0x804b758]
./makeinfo[0x805a307]
./makeinfo[0x805b910]
./makeinfo[0x805c5bc]
/lib/libc.so.6(__libc_start_main+0xdf)[0x125d7f]
./makeinfo[0x8049419]
======= Memory map: ========
00111000-00234000 r-xp 00000000 03:02 12025963   /lib/libc-2.3.6.so
00234000-00236000 r-xp 00122000 03:02 12025963   /lib/libc-2.3.6.so
00236000-00238000 rwxp 00124000 03:02 12025963   /lib/libc-2.3.6.so
00238000-0023a000 rwxp 00238000 00:00 0
00a3f000-00a48000 r-xp 00000000 03:02 12075462 
/lib/libgcc_s-4.0.2-20051126.so.1
00a48000-00a49000 rwxp 00009000 03:02 12075462 
/lib/libgcc_s-4.0.2-20051126.so.1
00bde000-00bdf000 r-xp 00bde000 00:00 0          [vdso]
00bdf000-00bf9000 r-xp 00000000 03:02 12026020   /lib/ld-2.3.6.so
00bf9000-00bfa000 r-xp 00019000 03:02 12026020   /lib/ld-2.3.6.so
00bfa000-00bfb000 rwxp 0001a000 03:02 12026020   /lib/ld-2.3.6.so
00fba000-00fbc000 r-xp 00000000 03:02 2261151    /usr/lib/gconv/KOI8-R.so
00fbc000-00fbe000 rwxp 00001000 03:02 2261151    /usr/lib/gconv/KOI8-R.so
08048000-0806f000 r-xp 00000000 03:02 2064954 
/home/wowa/build/texinfo-4.8/makeinfo/makeinfo
0806f000-08076000 rw-p 00026000 03:02 2064954 
/home/wowa/build/texinfo-4.8/makeinfo/makeinfo
08076000-08079000 rw-p 08076000 00:00 0
08089000-080aa000 rw-p 08089000 00:00 0          [heap]
b7c00000-b7c21000 rw-p b7c00000 00:00 0
b7c21000-b7d00000 ---p b7c21000 00:00 0
b7d85000-b7d86000 rw-p b7d85000 00:00 0
b7d86000-b7d8d000 r--s 00000000 03:02 2261183 
/usr/lib/gconv/gconv-modules.cache
b7d8d000-b7da0000 r--p 00000000 03:02 4145201 
/usr/share/locale/ru/LC_MESSAGES/texinfo.mo
b7da0000-b7dd3000 r--p 01d09000 03:02 7311470 
/usr/lib/locale/locale-archive
b7dd3000-b7fd3000 r--p 00000000 03:02 7311470 
/usr/lib/locale/locale-archive
b7fd3000-b7fd4000 rw-p b7fd3000 00:00 0
b7ff0000-b7ff1000 rw-p b7ff0000 00:00 0
bfd46000-bfd5c000 rw-p bfd46000 00:00 0          [stack]

Regards,
Vladimir