Tags: patch

Well, it's nice to have found the problem I myself reported...

After a couple hours of debugging the baselist::wordwrapinfo() function 
in dselect/baselist.cc (which is where dselect freezes), I found the 
problem was pretty much similar to a (harmless) buffer overflow...

I downloaded the source to dselect (1.13.11), compiled it under Sid, and 
(without stripping the dselect binary) ran it under GDB.  Same problem 
as before: trying to display the "ttf-microsoft-office" package froze 
the application.  Pressing CTRL-C revealed that it was in an infinite 
loop in the baselist::wordwrapinfo() function.

Investigating further, I discovered that the getyx() macro on line 349 
would return strange results (x == 179) once the 119th line passed to 
the function was processed.  And then, quite a while later in the day, 
I discovered the following in dselect/dselect.h:

    #define MAX_DISPLAY_INFO 120

Yes, that's right: trying to display more than MAX_DISPAY_INFO lines 
would cause the function to go into an infinite loop.  Changing the 
#define to, say, 250 fixed the problem for me, but the bug would have 
still remained...

The solution, of course, is to:

  (a) increase #define MAX_DISPLAY_INFO to something slightly larger
      (why 120, in any case?  That seems like an arbitrary choice)
  (b) check that that number of lines is not exceeded in the function
  (c) insert a message if it is

The attached patch does all of these things.  Please apply it!

PS: The fact that I am the first person to strike this bug in at least 
four years or so might suggest something... particularly about my 
package descriptions!

Yours truly,

John Zaitseff

-- 
John Zaitseff                    ,--_|\    The ZAP Group
Phone:  +61 2 9643 7737         /      \   Sydney, Australia
E-mail: [EMAIL PROTECTED]   \_,--._*   http://www.zap.org.au/
Finger: [EMAIL PROTECTED]               v
GnuPG   fingerprint:  8FD2 8962 7768 2546 FE07  DE7C 61A8 4486 C9A6 69B0
diff -ruN dpkg-1.13.11.orig/dselect/baselist.cc dpkg-1.13.11/dselect/baselist.cc
--- dpkg-1.13.11.orig/dselect/baselist.cc	2005-06-06 14:07:12.000000000 +1000
+++ dpkg-1.13.11/dselect/baselist.cc	2005-12-08 16:52:18.000000000 +1100
@@ -364,6 +364,11 @@
       wrapping= 1;
     }
     if (!p) break;
+    if (getcury(infopad) == (MAX_DISPLAY_INFO - 1)) {
+      waddstr(infopad, "[The package description is too long "
+                       "and has been truncated...]");
+      break;
+    }
     m= ++p;
   }
   if (debug) fprintf(debug,"baselist[%p]::wordwrapinfo() done\n",this);
diff -ruN dpkg-1.13.11.orig/dselect/dselect.h dpkg-1.13.11/dselect/dselect.h
--- dpkg-1.13.11.orig/dselect/dselect.h	2005-06-06 14:07:12.000000000 +1000
+++ dpkg-1.13.11/dselect/dselect.h	2005-12-08 16:46:15.000000000 +1100
@@ -24,7 +24,7 @@
 #define DSELECT_H
 
 #define TOTAL_LIST_WIDTH 180
-#define MAX_DISPLAY_INFO 120
+#define MAX_DISPLAY_INFO 250
 
 #include <signal.h>
 #undef ERR

Reply via email to