RISC OS Open
Safeguarding the past, present and future of RISC OS for everyone
ROOL
Home | News | Downloads | Bugs | Bounties | Forum | Documents | Photos | Contact us
Account

Previous|Next

  • Tickets
  • » Ticket #214

Ticket #214 (Fixed)Tue Jul 21 15:14:47 UTC 2009

TextGadgets post-filter's handling of Toolbox_ObjectDeleted is dangerously broken.

Reported by: Christopher Bazley (288) Severity: Critical
Part: RISC OS: Module Release:
Milestone: Status Fixed

Details by Christopher Bazley (288):

The first time that a Scrollbar, ScrollList or TextArea gadget is created for a client task, the TextGadgets module uses Toolbox_RegisterPostFilter to register SWI TextGadgets_Filter to be called before delivering events of type Toolbox_ObjectDeleted for Toolbox objects of Window class. Unfortunately, the code for handling Toolbox_ObjectDeleted events is horribly broken.

It searches the internal arrays of gadgets of each type for any which have a parent object ID which matches the Window that was just deleted. Upon finding such a TextArea or Scrollbar, it copies all the pointers above downwards, but does so in a very stupid and dangerous way ([n] := [2n], [n + 1] := [2n + 1], [n + 2] := [2n + 2], etc.) In fact, this corrupts the array contents from the orphaned gadget upwards:

// Found one! int j; for (j = i; text_area_list[j] != NULL; j++) { // Copy down following gadgets text_area_list[j] = text_area_list[j+i]; }

After having corrupted the contents of the array of pointers, the memory block containing it is expanded to a silly size instead of being shrunk, because the wrong type specifier is used with the ‘sizeof’ operator:

new_list = realloc(text_area_list, sizeof(PrivateTextArea) * (remaining + 1));

(The actual type of ‘text_area_list’ is ‘PrivateTextArea **’ and not ‘PrivateTextArea *’.)

I believe that SWI TextGadgets_Filter is never called for Toolbox_ObjectDeleted events because Toolbox module’s post-filter dispatcher is unable to determine the class of an object referenced in a Toolbox event if that object ID is no longer valid (as in this case). Therefore it uses 0 as the class ID, which mismatches the class ID specified in the TextGadgets module’s array of event interests.

Changelog:

Modified by Jeffrey Lee (213) Sat, June 25 2011 - 22:42:16 GMT

  • Status changed from Open to Fixed

This should now be fixed in TextGadgets 0.32.

http://www.riscosopen.org/viewer/revisions/logs…

  • Comment on, or change status of, this ticket

Previous|Next

Search tickets

Social

Follow us on and

ROOL Store

Buy RISC OS Open merchandise here, including SD cards for Raspberry Pi and more.

Donate! Why?

Help ROOL make things happen – please consider donating!

RISC OS IPR

RISC OS is an Open Source operating system owned by RISC OS Developments Ltd and licensed primarily under the Apache 2.0 license.

Options

  • Tickets
  • New ticket
  • Milestones
  • Subversion: Changesets
  • Subversion: Browse
  • CVS: Revisions
  • CVS: Browse
  • Search

RSS feeds Rss

  • Tickets
  • Everything!
  • More feeds...
Site design © RISC OS Open Limited 2018 except where indicated
The RISC OS Open Collaboa theme is distantly based on the Collaboa default layout

Valid XHTML 1.0  |  Valid CSS

Powered by Collaboa
This site runs on Rails

Hosted by Arachsys