View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0000432 | Far Manager | User Menu | public | 2007-12-12 19:42 | 2007-12-18 03:05 |
Reporter | alexmitin | Assigned To | vskirdin | ||
Priority | normal | Severity | crash | Reproducibility | always |
Status | closed | Resolution | fixed | ||
Fixed in Version | 1.80 alpha 1 | ||||
Summary | 0000432: Assertion while creating a submenu in User Menu | ||||
Description | There is a crash in while creating a submenu in User Menu. Steps to reproduce: 1) Start FAR 2) Press F2 3) Press Insert and then select "Insert menu", press Enter Assertion dialog: ------------------------------ HEAP CORRUPTION DETECTED: after Normal block (#19867) at 0x00AE3560. CRT detected that the application wrote to memory after end of heap buffer. ------------------------------ Analysis: =========== 1) Call stack: ----------- *1 Far.exe!_free_dbg_nolock(void * pUserData=0x00ae3560, int nBlockUse=1) 2 Far.exe!_free_dbg(void * pUserData=0x00ae3560, int nBlockUse=1) 3 Far.exe!free(void * pUserData=0x00ae3560) 4 Far.exe!xf_free(void * __block=0x00ae3560) 5 Far.exe!operator delete(void * ptr=0x00ae3560) 6 Far.exe!UnicodeStringData::FreeData(wchar_t * pData=0x00ae3560) 7 Far.exe!UnicodeStringData::~UnicodeStringData() 8 Far.exe!UnicodeStringData::`scalar deleting destructor'() 9 Far.exe!UnicodeStringData::DecRef() 10 Far.exe!UnicodeString::SetData(const UnicodeString & strCopy={...}) 11 Far.exe!UnicodeString::operator=(const UnicodeString & strCopy={...}) 12 Far.exe!Dialog::ShowDialog(int ID=0) 13 Far.exe!Dialog::DisplayObject() 14 Far.exe!ScreenObject::Show() 15 Far.exe!Dialog::Show() 16 Far.exe!Frame::OnChangeFocus(int focus=1) 17 Far.exe!Frame::Refresh() 18 Far.exe!Manager::RefreshCommit() 19 Far.exe!Manager::Commit() 20 Far.exe!Manager::Commit() 21 Far.exe!Manager::Commit() 22 Far.exe!Manager::ExecuteModal(Frame * Executed=0x0012a638) 23 Far.exe!Dialog::Process() 24 Far.exe!EditSubMenu(const wchar_t * MenuKey=0x009f8e08, int EditPos=0, int TotalRecords=0, int NewRec=1) 25 Far.exe!EditMenuRecord(const wchar_t * MenuKey=0x009f8e08, int EditPos=0, int TotalRecords=0, int NewRec=1) 26 Far.exe!ProcessSingleMenu(const wchar_t * MenuKey=0x009f8e08, int MenuPos=0, const wchar_t * Title=0x00000000) 27 Far.exe!ProcessUserMenu(int EditMenu=0) 28 Far.exe!CommandLine::ProcessKey(int Key=65649) 29 Far.exe!FilePanels::ProcessKey(int Key=65649) 30 Far.exe!Manager::ProcessKey(unsigned long Key=65649) 31 Far.exe!Manager::ProcessMainLoop() 32 Far.exe!Manager::EnterMainLoop() 33 Far.exe!MainProcess(const wchar_t * lpwszEditName=0x009f4fd0, const wchar_t * lpwszViewName=0x009f5068, const wchar_t * lpwszDestName1=0x009f5100, const wchar_t * lpwszDestName2=0x009f5198, int StartLine=-1, int StartChar=-1, int RegOpt=0) 34 Far.exe!wmain(int Argc=1, wchar_t * * Argv=0x009f5570) 2) Crash happens while executing this statement: void Dialog::ShowDialog(int ID) { ... case DI_TEXT: { strStr = CurItem->strData; 3) Function: UnicodeStringData::DecRef The value of "this" is the following: - this 0x00ae3520 UnicodeStringData * const m_nLength 18 m_nSize 20 m_nDelta 20 m_nRefCount 0 + m_pData 0x00ae3560 " Edit submenu label " The m_nLength=18. However the length of the string in m_pData is 20 (without terminating null). Looks like the string occupies the memory that does not belong to it. It's very possible that the actual bug is in the following code: void Dialog::ShowDialog(int ID) { ... strStr = CurItem->strData; TruncStrFromEnd(strStr,CW-2); // 5 ??? LenText=LenStrItem(I,strStr); if(LenText < CW-2) { lpwszStr = strStr.GetBuffer(); //BUGBUG memmove(lpwszStr+1, lpwszStr, (StrLength(lpwszStr)+1)*sizeof (wchar_t)); LenText = StrLength(lpwszStr); ... } | ||||
Additional Information | FAR 1.80.0.389 | ||||
Tags | No tags attached. | ||||
Build | 391 | ||||
|
alexmitin, попробуй вот такое: if(LenText < CW-2) { +>> strStr.SetLength(LenText+8); lpwszStr = strStr.GetBuffer(); //BUGBUG "8" - это для уверенности (перебор, конечно) ;-) А вообще... кто-то из UnicodeString.hpp удалил RShift, а здесь как раз эта операция и делается... |
|
в 390 попытка исправить ;-) |
|
падаем, у меня 100% повторяемость и на 390 (дебажная), стартовали - переключились в русский интерфейс - F2 - Ins - F1 - по Esc закрываем все диалоги - идем в F9 "cистемные параметры" и вот тут падаем. |
|
Подтверждаю. Падает. |
|
Вполне достаточно просто нажать F2 (пользовательское меню пустое), ESC, F9, "Системные параметры" и оно уже падает. |
2007-12-14 02:03
|
Fix432.diff (943 bytes)
Index: dialog.cpp =================================================================== --- dialog.cpp (revision 1388) +++ dialog.cpp (working copy) @@ -1563,18 +1563,14 @@ LenText=LenStrItem(I,strStr); if(LenText < CW-2) { - lpwszStr = strStr.GetBuffer(); //BUGBUG + int iLen = strStr.GetLength(); + lpwszStr = strStr.GetBuffer(iLen + 3); + { + wmemmove(lpwszStr+1, lpwszStr, iLen); + *lpwszStr = lpwszStr[++iLen] = L' '; + } + strStr.ReleaseBuffer(iLen+1); - memmove(lpwszStr+1, lpwszStr, (StrLength(lpwszStr)+1)*sizeof (wchar_t)); - - LenText = StrLength(lpwszStr); - - *lpwszStr = lpwszStr[LenText]=L' '; - - lpwszStr[LenText+1] = 0; - - strStr.ReleaseBuffer(); - LenText=LenStrItem(I, strStr); } X=X1+CX1+(CW-LenText)/2; |
|
Fixed 0000430, 0000431, 0000432. See "Fix432.diff" file in the attachment. |
|
see 391 |
|
Verified in 1.80.0.391. |
Date Modified | Username | Field | Change |
---|---|---|---|
2007-12-12 19:42 | alexmitin | New Issue | |
2007-12-13 04:36 | vskirdin | Note Added: 0001027 | |
2007-12-13 04:48 | vskirdin | Note Edited: 0001027 | |
2007-12-13 10:34 | vskirdin | Status | new => assigned |
2007-12-13 10:34 | vskirdin | Assigned To | => vskirdin |
2007-12-13 10:35 | vskirdin | Note Added: 0001030 | |
2007-12-13 10:35 | vskirdin | Status | assigned => feedback |
2007-12-13 21:12 | samlyukov | Note Added: 0001031 | |
2007-12-14 00:41 | DiRTy_GaRRy | Note Added: 0001032 | |
2007-12-14 00:45 | DiRTy_GaRRy | Note Added: 0001033 | |
2007-12-14 02:03 | alexmitin | File Added: Fix432.diff | |
2007-12-14 02:06 | alexmitin | Note Added: 0001034 | |
2007-12-14 04:10 | vskirdin | Note Added: 0001035 | |
2007-12-14 19:27 | alexmitin | Status | feedback => resolved |
2007-12-14 19:27 | alexmitin | Resolution | open => fixed |
2007-12-14 19:27 | alexmitin | Note Added: 0001043 | |
2007-12-18 03:05 | vskirdin | Build | => 391 |
2007-12-18 03:05 | vskirdin | Status | resolved => closed |
2007-12-18 03:05 | vskirdin | Fixed in Version | => 1.80 alpha 1 |