Bug 17676 - Uninitialized variable in HtmlFont.cc causes segfault
Summary: Uninitialized variable in HtmlFont.cc causes segfault
Status: RESOLVED FIXED
Alias: None
Product: poppler
Classification: Unclassified
Component: general (show other bugs)
Version: unspecified
Hardware: All All
: medium normal
Assignee: poppler-bugs
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-09-20 05:21 UTC by Tomas Are Haavet
Modified: 2008-09-20 06:46 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Tomas Are Haavet 2008-09-20 05:21:05 UTC
The pos variable in HtmlFont may not be initialized in the HtmlFont::HtmlFont(GooString* ftname,int _size, GfxRGB rgb) constructor, if fontname is set to NULL. This may cause a segfault e.g. in HtmlFont::isEqualIgnoreBold().

diff --git a/utils/HtmlFonts.cc b/utils/HtmlFonts.cc
index 3598e7f..38bafe5 100644
--- a/utils/HtmlFonts.cc
+++ b/utils/HtmlFonts.cc
@@ -132,7 +132,10 @@ HtmlFont::HtmlFont(GooString* ftname,int _size, GfxRGB rgb){
     pos=i;
     delete fontname;
   }  
-  if (!DefaultFont) DefaultFont=new GooString(fonts[font_num].name);
+  if (!DefaultFont) {
+    pos = font_num;
+    DefaultFont=new GooString(fonts[pos].name);
+  }
 
 }
Comment 1 Albert Astals Cid 2008-09-20 06:34:36 UTC
Patch looks wrong, i'd say the equal needs to be outside the 
if (!DefaultFont) {

Do you agree?
Comment 2 Tomas Are Haavet 2008-09-20 06:42:02 UTC
Absolutely, sorry about that. You're thinking of something like this instead? We only need to assign pos if the fontname variable is NULL.

diff --git a/utils/HtmlFonts.cc b/utils/HtmlFonts.cc
index 3598e7f..ed8656c 100644
--- a/utils/HtmlFonts.cc
+++ b/utils/HtmlFonts.cc
@@ -131,7 +131,8 @@ HtmlFont::HtmlFont(GooString* ftname,int _size, GfxRGB rgb){
 	}
     pos=i;
     delete fontname;
-  }  
+  } else
+    pos = font_num;
   if (!DefaultFont) DefaultFont=new GooString(fonts[font_num].name);
 
 }
Comment 3 Albert Astals Cid 2008-09-20 06:46:58 UTC
Fix commited for poppler 0.9.2


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.