Menu

#1768 Prevent a negative overflow

Bug
closed-fixed
5
2015-11-06
2015-10-16
No

When running without assertions enabled the stc control can become unresponsive as it counts down from -1 to 0: This is when SetStyling has been called with a negative length.
The assertion tries to disallow negative numbers, although these are not always enabled. The patch offers a nicer way of handling invalid input.

1 Attachments

Discussion

  • Neil Hodgson

    Neil Hodgson - 2015-10-16

    Styling a negative range is always a bug. This change hides any problems down at the lowest level of the code. What call path is producing problems?

    Making the problem more obvious (such as by setting the error code if its a result of SCI_SETSTYLING) may lead to better fixes.

     
  • Neil Hodgson

    Neil Hodgson - 2015-10-17
    • Priority: 8 --> 5
     
  • Damien Ruscoe

    Damien Ruscoe - 2015-10-19

    You are correct; the source of this bug was in my code. I was attempting to calculate an offset, for styling, using unicode characters and got my encodings wrong, this was producing a negative offset.

    The bt for this (cutting out the wxPython levels)...
    0 CellBuffer::SetStyleFor (this=0xec2b90, position=0, lengthStyle=-1, styleValue=0 '\000', mask=0 '\000') at /home/druscoe/development/build/wxPython-3.0/src/stc/scintilla/src/CellBuffer.cxx:418
    1 0x00007ffff60e6bf1 in Document::SetStyleFor (this=0xec2b70, length=-1, style=0 '\000') at /home/druscoe/development/build/wxPython-3.0/src/stc/scintilla/src/Document.cxx:1719
    2 0x00007ffff6110e79 in Editor::WndProc (this=0xec32a0, iMessage=2033, wParam=18446744073709551615, lParam=0) at /home/druscoe/development/build/wxPython-3.0/src/stc/scintilla/src/Editor.cxx:7795
    3 0x00007ffff612c29a in ScintillaBase::WndProc (this=0xec32a0, iMessage=2033, wParam=18446744073709551615, lParam=0) at /home/druscoe/development/build/wxPython-3.0/src/stc/scintilla/src/ScintillaBase.cxx:896
    4 0x00007ffff6014ae1 in ScintillaWX::WndProc (this=0xec32a0, iMessage=2033, wParam=18446744073709551615, lParam=0) at /home/druscoe/development/build/wxPython-3.0/src/stc/ScintillaWX.cpp:769
    5 0x00007ffff5fff21c in wxStyledTextCtrl::SendMsg (this=0xeb6240, msg=2033, wp=18446744073709551615, lp=0) at /home/druscoe/development/build/wxPython-3.0/src/stc/stc.cpp:238
    6 0x00007ffff5fffb81 in wxStyledTextCtrl::SetStyling (this=0xeb6240, length=-1, style=0) at /home/druscoe/development/build/wxPython-3.0/src/stc/stc.cpp:496

    My bug was being hidden by the fact that the code worked on the test platform, but crashed the application when being ported to others.
    The patch does hide the bug further by making the invalid input into a no-op (Working with the philosophy of crap-in crap-out); so an exception may be a better resolution to make it as noisy as possible.
    The current behaviour of iterating a range of numbers for no reason and being resonably quiet about the error could definatly be improved upon. I shall leave this decision in your hands as wiser minds will understand how to make this consistant with the rest of the interface.

    Thanks.
    Damien,

     
  • Neil Hodgson

    Neil Hodgson - 2015-10-19
    • labels: style --> style, scintilla
    • status: open --> open-fixed
    • assigned_to: Neil Hodgson
     
  • Neil Hodgson

    Neil Hodgson - 2015-10-19

    Fix committed as [29b245]. Detects negative length and reports as SC_STATUS_FAILURE.

     

    Related

    Commit: [29b245]

  • Neil Hodgson

    Neil Hodgson - 2015-11-06
    • status: open-fixed --> closed-fixed
     

Log in to post a comment.

MongoDB Logo MongoDB