Segmentation core dump in fillbetween.dem due to "%lf %lf %lf"

[Daniel J S. <dan...@ie...>]

I'm seeing a core dump in one of the demos, fillbetween.dem:

	G N U P L O T
	Version 4.7 patchlevel 0    last modified 2012-06-19

	Copyright (C) 1986-1993, 1998, 2004, 2007-2012
	Thomas Williams, Colin Kelley and many others

	gnuplot home:     http://www.gnuplot.info
	mailing list:     gnu...@li...
	faq, bugs, etc:   type "help FAQ"
	immediate help:   type "help"  (plot window: hit 'h')

Terminal type set to 'qt'
gnuplot> set title "Fill area between two curves"
gnuplot> set style data lines
gnuplot> set xrange [10:*]
gnuplot> set yrange [0:175]
gnuplot> plot 'silver.dat' u 1:2:3 "%lf %lf %lf" w filledcu, \
>      '' u 1:2 lt -1 notitle, '' u 1:3 lt -1 notitle
Segmentation fault (core dumped)


Removing the "%lf %lf %lf" format specifier fixes the problem:

Terminal type set to 'qt'
gnuplot> set title "Fill area between two curves"
gnuplot> set style data lines
gnuplot> set xrange [10:*]
gnuplot> set yrange [0:175]
gnuplot> plot 'silver.dat' u 1:2:3  w filledcu, \
>     '' u 1:2 lt -1 notitle, '' u 1:3 lt -1 notitle


I think the problem is a recent change:

http://gnuplot.cvs.sourceforge.net/viewvc/gnuplot/gnuplot/src/datafile.c?r1=1.260&r2=1.261

I looks like there are some tricky string writes and memory frees.  This 
line looks suspicious:

      snprintf(placeholder+11, 4, "%02d@", column_for_key_title);

if

static char placeholder[] = "@COLUMNHEAD00@";

Adding 11 to the placeholder pointer puts the pointer at the first 0 of 
"...00@".  If I'm not mistaken, %02d means a minimum of 2 digits so it 
could be more than 2 digits wide.  If it is more than two digits wide, 
then either the @ or some other numeral is in the fourth position and 
will overwrite the null terminating string and memory could be accessed 
outside of a segment from a run-away string.  It should be

      snprintf(placeholder+11, 3, "%02d@", column_for_key_title);

but if one wants to ensure that an at-symbol @ appears at the end of the 
string and there is adequate space for a large number, then some other 
strategy is needed.

Could be in clearing the headers, on the other hand.

Dan