Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sources.redhat.com/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Date:	Thu, 23 May 2002 12:11:24 +0200
From:	Pavel Tsekov <ptsekov AT syntrex DOT com>
Reply-To:	Pavel Tsekov <cygwin AT cygwin DOT com>
Organization:	Syntrex, Inc.
X-Priority:	3 (Normal)
Message-ID:	<1463342396.20020523121124@syntrex.com>
To:	"Robert Collins" <robert DOT collins AT itdomain DOT com DOT au>
CC:	cygwin AT cygwin DOT com
Subject:	Re[7]: setup-2.243 Crash / Install from Local Directory / WinXP
In-Reply-To:	<FC169E059D1A0442A04C40F86D9BA7600C6145@itdomain003.itdomain.net.au>
References:	<FC169E059D1A0442A04C40F86D9BA7600C6145 AT itdomain003 DOT itdomain DOT net DOT au>
MIME-Version:	1.0

Hello Robert,

Thursday, May 23, 2002, 11:47:26 AM, you wrote:

>> Well, this will fix the problem, but String::substr() will
>> still cause a crash if for some reason a NULL pointer is 
>> passed to it! Btw have you read my mail till the end ?

RC> Yes. The String++ implementation currently uses the <string> std class
RC> to implement substr. From a quick inspection the fault is in the
RC> string() constructor not returning an empty string when NULL is passed
RC> to it.

No! The string constructor which uses const char * as its argument - there is
no check if the pointer being passed is NULL and later strlen () is
called on the pointer to determined the size of the C string being
passed... Here is the exact flow:

1. The constructor
 basic_string (const charT* s)
    : dat (nilRep.grab ()) { assign (s); }

2. The assign call
  basic_string& assign (const charT* s)
    { return assign (s, traits::length (s)); }

3. The call to traits::length()
  static size_t length (const char_type* s)     { return strlen (s); }

The crash happens in 3 - a string object is never constructed at all
and string::substr() is never called. This is a bug of the string
implementation  in 2.95.3. I'am aware of this because I've done alot of
usage of strings lately and was bit by this. I avoid this by calling
string::assign () instead of the string (const char *) constructor
which is safe.


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

- Raw text -