gnuplot segfaults on keyboard interaction

[Benjamin L. <lin...@gm...>]

Hello list,

I have encountered a nasty problem, namely gnuplot segfaulting if called with a script name and the persistent option and the user then using the terminal window interactively - specifically toggling grid via keyboard 'g'.

Ok, for the details, I see this on windows platform using the windows terminal and only for the 4.5.0 branch, *not* for the 4.4.0 branch.

I am using gnuplot as follows
/path/to/gnuplot/wgnuplot -p foo.gp

where foo.gp simply sets terminal to windows and plots something in 2d like in

  set term windows
  plot [0:2*pi] sin(x) with linespoints, cos(x) with linespoints

Now pressing "g" crashes gnuplot. 
And the nasty part is, it does not always crash (I love those errors...)

But I managed to (hopefully) track it down to :
 event_keypress()
 builtin_toggle_grid()
 do_string_replot()
 replotrequest()
 m_capture()  <- segfault

Here m_capture() is called with both the parameters "start" and "end" as -1 which (not surprisingly) leads to problems as the array token[] is indexed with both start and end.

The problem is, that at the time replotrequest() is called from within do_string_replot(), c_token is -1 and num_token is zero (Why? because do_string_and_free() calls lf_pop(), which sets c_token=-1 and num_token=0).

But apparently replotrequest() assumes that neither is the case, instead it tries to read tokens where there are none. 

I don't know where the actual problem lies here. Is it not allowed to call replotrequest() when no tokens are available? Or should replotrequest() make sure that there are tokens available instead of blindly assuming it?

Besides, already replotrequest() accesses token[last_token] (before calling m_capture()) but last_token is -1 if num_tokens is 0 ( as it is the case! ). This makes size_t newlen contain a random number....

I can work around the segfault by the following change

--- a/src/util.c
+++ b/src/util.c
@@ -318,6 +321,9 @@
 void
 m_capture(char **str, int start, int end)
 {
+    if (start<0 || end<0)
+       return;
+
     int i, e;
     char *s;

but this is (I believe) the wrong place to fix the problem, as replotrequest still accesses token[-1]...

benjamin

-- 
GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01