Re: [Gnuplot-bugs] Re: gnuplot cvs x11 terminal bug

[Hans-Bernhard B. <br...@ph...>]

Ethan A Merritt wrote:
> /lib/libc.so.6(__chk_fail+0x41)[0x586c45]
> gnuplot_x11[0x804aaa2]          Find_Plot_In_Linked_List_By_Number
> gnuplot_x11[0x80576b6]          mainloop (gplt_x11.c line 1326, I think)

That traceback appears garbled.  mainloop() doesn't call 
Find_..._By_Number() --- it only does so indirectly, through record(), 
which definitely is too complex for the compiler having dared to inline it.

> gnuplot_x11[0x8059319]          main

> I can't see how Find_Plot_In_Linked_List_By_Number() would ever
> cause a buffer overflow,

Well, it's operating on a linked list.  Linked list manipulation *can* 
go wrong, e.g. killing the NULL pointer at the end, or leaving behind 
nodes that have been free()d, but not removed from the list.  I'm not at 
all convinced that this __chk_fail stuff is able to distinguish genuine 
buffer overflows from other rogue pointers.

As I told the OP before, I'm quite sure that this can't be resolved 
meaningfully without running the test inside a debugger, where data 
structures can be inspected.