Re: Segmentation core dump in fillbetween.dem due to "%lf %lf %lf"

[sfeam (E. Merritt) <eam...@gm...>]

On Wednesday, 07 August 2013, Daniel J Sebald wrote:
> I'm seeing a core dump in one of the demos, fillbetween.dem:

Thanks for catching that, Dan.

The immediate cause of the segfault is much simpler and stupider
on my part than the path you are worried about.  I foolishly tried
to reserve enough space for the columheader in the output string
by calling strlen(df_column[j].header),  but if there is no column
header then this is NULL.  strlen doesn't like NULL, so -- boom.

As to overflowing the format, I did worry about that.
It would overflow in the 4th digit, so you are OK up to 999 columns
of input, and I think the program will reject that many for other reasons.  
Even if there are more than 3 digits, what happens is the title
string being constructed is corrupted by the presence of the extra
digits in the middle of the result.  It doesn't overflow the total length.
But you are correct that for 100% cleanliness the code could
check explicitly against a maximum number of allowed columns.
I'm not sure what that maximum is.

Fixed in CVS, and thanks again for catching it so quickly.

	Ethan

> 
> 	G N U P L O T
> 	Version 4.7 patchlevel 0    last modified 2012-06-19
> 
> 	Copyright (C) 1986-1993, 1998, 2004, 2007-2012
> 	Thomas Williams, Colin Kelley and many others
> 
> 	gnuplot home:     http://www.gnuplot.info
> 	mailing list:     gnu...@li...
> 	faq, bugs, etc:   type "help FAQ"
> 	immediate help:   type "help"  (plot window: hit 'h')
> 
> Terminal type set to 'qt'
> gnuplot> set title "Fill area between two curves"
> gnuplot> set style data lines
> gnuplot> set xrange [10:*]
> gnuplot> set yrange [0:175]
> gnuplot> plot 'silver.dat' u 1:2:3 "%lf %lf %lf" w filledcu, \
> >      '' u 1:2 lt -1 notitle, '' u 1:3 lt -1 notitle
> Segmentation fault (core dumped)
> 
> 
> Removing the "%lf %lf %lf" format specifier fixes the problem:
> 
> Terminal type set to 'qt'
> gnuplot> set title "Fill area between two curves"
> gnuplot> set style data lines
> gnuplot> set xrange [10:*]
> gnuplot> set yrange [0:175]
> gnuplot> plot 'silver.dat' u 1:2:3  w filledcu, \
> >     '' u 1:2 lt -1 notitle, '' u 1:3 lt -1 notitle
> 
> 
> I think the problem is a recent change:
> 
> http://gnuplot.cvs.sourceforge.net/viewvc/gnuplot/gnuplot/src/datafile.c?r1=1.260&r2=1.261
> 
> I looks like there are some tricky string writes and memory frees.  This 
> line looks suspicious:
> 
>       snprintf(placeholder+11, 4, "%02d@", column_for_key_title);
> 
> if
> 
> static char placeholder[] = "@COLUMNHEAD00@";
> 
> Adding 11 to the placeholder pointer puts the pointer at the first 0 of 
> "...00@".  If I'm not mistaken, %02d means a minimum of 2 digits so it 
> could be more than 2 digits wide.  If it is more than two digits wide, 
> then either the @ or some other numeral is in the fourth position and 
> will overwrite the null terminating string and memory could be accessed 
> outside of a segment from a run-away string.  It should be
> 
>       snprintf(placeholder+11, 3, "%02d@", column_for_key_title);
> 
> but if one wants to ensure that an at-symbol @ appears at the end of the 
> string and there is adequate space for a large number, then some other 
> strategy is needed.
> 
> Could be in clearing the headers, on the other hand.
> 
> Dan