[GRASS5] [bug #4095] (grass) SIGSEGV in Vect_cidx_find_next

Request Tracker grass-bugs at intevation.de
Thu Feb 16 12:14:39 EST 2006

this bug's URL: http://intevation.de/rt/webrt?serial_num=4095

Subject: SIGSEGV in Vect_cidx_find_next

Platform: GNU/Linux/x86
grass obtained from: Trento Italy site
grass binary for platform: Downloaded precompiled Binaries
GRASS Version: 6.0.1RC4

The function Vect_cidx_find_next() contains 3 critical bugs:

(1) bsearch() is called to find an element in the cat index where its cat
    value matches the given value.  The implemented logic ignores the fact
    that bsearch() does _not_ return the first element but rather _any_
    element that matches.  So there is the potential to loose elements with
    successive scans on the cat index.

(2) When the type mask is evaluated, the cat value is ignored.  Thus, the
    returned id might refer to an element with a completely different cat

(3) The offset calculations for the second parameter passed to bsearch() are
    wrong.  A single element in the "ci->cat" array already has a size of
    "3 * sizeof(int)".  Multiplying the start_index with this size will
    effectively result in an invalid offset, which can lead to traps or other
    memory corruptions.

Proposed fixes:
(1) add the following piece after the bsearch() and the determination of

while (cat_index > start_index && ci->cat[cat_index-1][0] == cat) {

(2) fix the do-while loop at the end of the function like this:

do {
    if (ci->cat[cat_index][0] != cat) {
        return -1;
    if (ci->cat[cat_index][1] & type_mask) {
        *type = ci->cat[cat_index][1];
        *id = ci->cat[cat_index][2];
        return cat_index;
} while (cat_index < ci->n_cats);

(3) correct the parameters for bsearch() in the following way:

catp = bsearch(&cat, &ci->cat[start_index], ci->n_cats - start_index,
        sizeof ci->cat[0], cmp_cat);

Knut Stolze

-------------------------------------------- Managed by Request Tracker

More information about the grass-dev mailing list