From: Enlightenment S. <no-...@en...> - 2011-06-20 21:59:37
|
Log: Edje: fix invalid read on edje embryo get_part_id It was expecting for a null terminator. But that wasn't the case. Using parts_count instead. Author: bdilly Date: 2011-06-20 14:59:31 -0700 (Mon, 20 Jun 2011) New Revision: 60537 Trac: http://trac.enlightenment.org/e/changeset/60537 Modified: branches/edje-1.0/ChangeLog branches/edje-1.0/src/lib/edje_embryo.c trunk/edje/src/lib/edje_embryo.c Modified: branches/edje-1.0/ChangeLog =================================================================== --- branches/edje-1.0/ChangeLog 2011-06-20 21:31:51 UTC (rev 60536) +++ branches/edje-1.0/ChangeLog 2011-06-20 21:59:31 UTC (rev 60537) @@ -36,3 +36,7 @@ * Fix an issue with ellipsis not working properly with small text parts. +2011-06-20 Bruno Dilly + + * Fix an invalid memory read on edje embryo's function get_part_id. + Modified: branches/edje-1.0/src/lib/edje_embryo.c =================================================================== --- branches/edje-1.0/src/lib/edje_embryo.c 2011-06-20 21:31:51 UTC (rev 60536) +++ branches/edje-1.0/src/lib/edje_embryo.c 2011-06-20 21:59:31 UTC (rev 60537) @@ -807,6 +807,7 @@ Edje_Part_Collection *col; Edje_Part **part; char *p; + unsigned int i; CHKPARAM(1); ed = embryo_program_data_get(ep); @@ -814,7 +815,8 @@ if (!p) return -1; col = ed->collection; if (!col) return -1; - for (part = col->parts; *part; part++) + part = col->parts; + for (i = 0; i < col->parts_count; i++, part++) { if (!(*part)->name) continue; if (!strcmp((*part)->name, p)) return (*part)->id; Modified: trunk/edje/src/lib/edje_embryo.c =================================================================== --- trunk/edje/src/lib/edje_embryo.c 2011-06-20 21:31:51 UTC (rev 60536) +++ trunk/edje/src/lib/edje_embryo.c 2011-06-20 21:59:31 UTC (rev 60537) @@ -807,6 +807,7 @@ Edje_Part_Collection *col; Edje_Part **part; char *p; + unsigned int i; CHKPARAM(1); ed = embryo_program_data_get(ep); @@ -814,7 +815,8 @@ if (!p) return -1; col = ed->collection; if (!col) return -1; - for (part = col->parts; *part; part++) + part = col->parts; + for (i = 0; i < col->parts_count; i++, part++) { if (!(*part)->name) continue; if (!strcmp((*part)->name, p)) return (*part)->id; |