[bug #44099] info segfaults on xterm when window height is very small

[Vitezslav Crhonek]

URL:
  <http://savannah.gnu.org/bugs/?44099>

                 Summary: info segfaults on xterm when window height is very
small
                 Project: texinfo - GNU documentation system
            Submitted by: vcrhonek
            Submitted on: Tue 27 Jan 2015 12:34:37 PM GMT
                Category: info
                 Release: 
                Priority: 5 - Normal
                Severity: 3 - Normal
              Item Group: None
                 Privacy: Public
             Open/Closed: Open
             Assigned to: None
         Discussion Lock: Any
                  Status: None

    _______________________________________________________

Details:

Can be easily reproduced, just run "info", or "info info". I've seen it on
Fedora and Arch Linux.

It's caused by double free error. Patch fixing it is attached.

But that helps only partially, there's still an issue in
display_update_one_window() and display_node_text().

It fails on
display.c:138
if (entry->inverse

It seems that
DISPLAY_LINE *entry = display[win->first_row + pline_index];
is not NULL, but points into unallocated/unowned memory, which
causes segfault when accessing this memory.

I tried to workaround it, but my knowledge of the info code is not deep
enough... See the second patch for illustration, it improves the situation a
bit, but info still fails sometimes (although in different part of the
program) and the output is not 100 % correct in all cases (window sizes).




    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Tue 27 Jan 2015 12:34:37 PM GMT  Name: texinfo-5.2-double-free.patch 
Size: 482B   By: vcrhonek

<http://savannah.gnu.org/bugs/download.php?file_id=32916>
-------------------------------------------------------
Date: Tue 27 Jan 2015 12:34:37 PM GMT  Name: test.patch  Size: 1kB   By:
vcrhonek

<http://savannah.gnu.org/bugs/download.php?file_id=32917>

    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?44099>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/