Bug#293939: #293939 joe in html mode segfaults

[Jarno Elonen]

 This patch would still apply to 3.3, but I can't seem to reproduce the bug.

Well, this patch almost certainly isn't the *correct* way to fix the bug, so 
if you could reproduce the crash in 3.1 but not in 3.3, I think it's safe to 
assume the bug's been fixed. I actually intended the patch more as a 
demonstration of the bug instead of a real fix.

- Jarno


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Bug#293939: #293939 joe in html mode segfaults

[Josip Rodin]

On Sun, Jul 10, 2005 at 06:49:35PM +0300, Jarno Elonen wrote:
 I don't really understand the internals of JOE, but it looks like
 the crash occurs because the editor tries to remove a 
 corrupt/non-existent/orphaned link from a doubly linked list in
 b.c line 334 (using the deque_f macro from queue.h on line 29).
 
 This quick fix prevents the segfault but might leak memory, cause
 some other defects and/or mask the real bug:
 
 --- orig/joe-3.1/b.c2004-05-27 01:23:37.0 +0300
 +++ joe-3.1/b.c 2005-07-10 18:16:26.0 +0300
 @@ -331,7 +331,8 @@
 *p-owner = NULL;
 if (p-ptr)
 vunlock(p-ptr);
 -   pfree(deque_f(P, link, p));
 +   if ( p-link.prev  p-link.next )
 +   pfree(deque_f(P, link, p));
  }
 
  P *pset(P *n, P *p)

This patch would still apply to 3.3, but I can't seem to reproduce the bug.
Guys?

-- 
 2. That which causes joy or happiness.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Bug#293939: #293939 joe in html mode segfaults

[Jarno Elonen]

I don't really understand the internals of JOE, but it looks like
the crash occurs because the editor tries to remove a 
corrupt/non-existent/orphaned link from a doubly linked list in
b.c line 334 (using the deque_f macro from queue.h on line 29).

This quick fix prevents the segfault but might leak memory, cause
some other defects and/or mask the real bug:

--- orig/joe-3.1/b.c2004-05-27 01:23:37.0 +0300
+++ joe-3.1/b.c 2005-07-10 18:16:26.0 +0300
@@ -331,7 +331,8 @@
*p-owner = NULL;
if (p-ptr)
vunlock(p-ptr);
-   pfree(deque_f(P, link, p));
+   if ( p-link.prev  p-link.next )
+   pfree(deque_f(P, link, p));
 }

 P *pset(P *n, P *p)


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]