View Issue Details

IDProjectCategoryView StatusLast Update
0000432Far ManagerUser Menupublic2007-12-18 03:05
Reporteralexmitin Assigned Tovskirdin  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Fixed in Version1.80 alpha 1 
Summary0000432: Assertion while creating a submenu in User Menu
DescriptionThere is a crash in while creating a submenu in User Menu.

Steps to reproduce:

1) Start FAR
2) Press F2
3) Press Insert and then select "Insert menu", press Enter

Assertion dialog:
------------------------------
HEAP CORRUPTION DETECTED: after Normal block (#19867) at 0x00AE3560.
CRT detected that the application wrote to memory after end of heap buffer.
------------------------------

Analysis:
===========

1) Call stack:
-----------
*1 Far.exe!_free_dbg_nolock(void * pUserData=0x00ae3560, int nBlockUse=1)
 2 Far.exe!_free_dbg(void * pUserData=0x00ae3560, int nBlockUse=1)
 3 Far.exe!free(void * pUserData=0x00ae3560)
 4 Far.exe!xf_free(void * __block=0x00ae3560)
 5 Far.exe!operator delete(void * ptr=0x00ae3560)
 6 Far.exe!UnicodeStringData::FreeData(wchar_t * pData=0x00ae3560)
 7 Far.exe!UnicodeStringData::~UnicodeStringData()
 8 Far.exe!UnicodeStringData::`scalar deleting destructor'()
 9 Far.exe!UnicodeStringData::DecRef()
 10 Far.exe!UnicodeString::SetData(const UnicodeString & strCopy={...})
 11 Far.exe!UnicodeString::operator=(const UnicodeString & strCopy={...})
 12 Far.exe!Dialog::ShowDialog(int ID=0)
 13 Far.exe!Dialog::DisplayObject()
 14 Far.exe!ScreenObject::Show()
 15 Far.exe!Dialog::Show()
 16 Far.exe!Frame::OnChangeFocus(int focus=1)
 17 Far.exe!Frame::Refresh()
 18 Far.exe!Manager::RefreshCommit()
 19 Far.exe!Manager::Commit()
 20 Far.exe!Manager::Commit()
 21 Far.exe!Manager::Commit()
 22 Far.exe!Manager::ExecuteModal(Frame * Executed=0x0012a638)
 23 Far.exe!Dialog::Process()
 24 Far.exe!EditSubMenu(const wchar_t * MenuKey=0x009f8e08, int EditPos=0, int TotalRecords=0, int NewRec=1)
 25 Far.exe!EditMenuRecord(const wchar_t * MenuKey=0x009f8e08, int EditPos=0, int TotalRecords=0, int NewRec=1)
 26 Far.exe!ProcessSingleMenu(const wchar_t * MenuKey=0x009f8e08, int MenuPos=0, const wchar_t * Title=0x00000000)
 27 Far.exe!ProcessUserMenu(int EditMenu=0)
 28 Far.exe!CommandLine::ProcessKey(int Key=65649)
 29 Far.exe!FilePanels::ProcessKey(int Key=65649)
 30 Far.exe!Manager::ProcessKey(unsigned long Key=65649)
 31 Far.exe!Manager::ProcessMainLoop()
 32 Far.exe!Manager::EnterMainLoop()
 33 Far.exe!MainProcess(const wchar_t * lpwszEditName=0x009f4fd0, const wchar_t * lpwszViewName=0x009f5068, const wchar_t * lpwszDestName1=0x009f5100, const wchar_t * lpwszDestName2=0x009f5198, int StartLine=-1, int StartChar=-1, int RegOpt=0)
 34 Far.exe!wmain(int Argc=1, wchar_t * * Argv=0x009f5570)


2) Crash happens while executing this statement:

void Dialog::ShowDialog(int ID)
{
...
      case DI_TEXT:
      {
        strStr = CurItem->strData;


3) Function: UnicodeStringData::DecRef
The value of "this" is the following:

- this 0x00ae3520 UnicodeStringData * const
  m_nLength 18
  m_nSize 20
  m_nDelta 20
  m_nRefCount 0
+ m_pData 0x00ae3560 " Edit submenu label "

The m_nLength=18. However the length of the string in m_pData is 20 (without terminating null).
Looks like the string occupies the memory that does not belong to it.


It's very possible that the actual bug is in the following code:

void Dialog::ShowDialog(int ID)
{
...
  strStr = CurItem->strData;
  TruncStrFromEnd(strStr,CW-2); // 5 ???
  LenText=LenStrItem(I,strStr);
  if(LenText < CW-2)
  {
    lpwszStr = strStr.GetBuffer(); //BUGBUG
    memmove(lpwszStr+1, lpwszStr, (StrLength(lpwszStr)+1)*sizeof (wchar_t));
    LenText = StrLength(lpwszStr);
...
}
Additional InformationFAR 1.80.0.389
TagsNo tags attached.
Build391

Activities

vskirdin

2007-12-13 04:36

administrator   bugnote:0001027

Last edited: 2007-12-13 04:48

alexmitin, попробуй вот такое:

if(LenText < CW-2)
  {
+>> strStr.SetLength(LenText+8);
    lpwszStr = strStr.GetBuffer(); //BUGBUG


"8" - это для уверенности (перебор, конечно) ;-)

А вообще... кто-то из UnicodeString.hpp удалил RShift, а здесь как раз эта операция и делается...

vskirdin

2007-12-13 10:35

administrator   bugnote:0001030

в 390 попытка исправить ;-)

samlyukov

2007-12-13 21:12

reporter   bugnote:0001031

падаем, у меня 100% повторяемость и на 390 (дебажная),
стартовали - переключились в русский интерфейс - F2 - Ins - F1 - по Esc закрываем все диалоги - идем в F9 "cистемные параметры" и вот тут падаем.

DiRTy_GaRRy

2007-12-14 00:41

developer   bugnote:0001032

Подтверждаю. Падает.

DiRTy_GaRRy

2007-12-14 00:45

developer   bugnote:0001033

Вполне достаточно просто нажать F2 (пользовательское меню пустое), ESC, F9, "Системные параметры" и оно уже падает.

2007-12-14 02:03

 

Fix432.diff (943 bytes)   
Index: dialog.cpp
===================================================================
--- dialog.cpp	(revision 1388)
+++ dialog.cpp	(working copy)
@@ -1563,18 +1563,14 @@
           LenText=LenStrItem(I,strStr);
           if(LenText < CW-2)
           {
-              lpwszStr = strStr.GetBuffer(); //BUGBUG
+			  int iLen = strStr.GetLength();
+			  lpwszStr = strStr.GetBuffer(iLen + 3);
+			  {
+				  wmemmove(lpwszStr+1, lpwszStr, iLen);
+				  *lpwszStr = lpwszStr[++iLen] = L' ';
+			  }
+              strStr.ReleaseBuffer(iLen+1);
 
-              memmove(lpwszStr+1, lpwszStr, (StrLength(lpwszStr)+1)*sizeof (wchar_t));
-
-              LenText = StrLength(lpwszStr);
-
-              *lpwszStr = lpwszStr[LenText]=L' ';
-
-              lpwszStr[LenText+1] = 0;
-
-              strStr.ReleaseBuffer();
-
               LenText=LenStrItem(I, strStr);
           }
           X=X1+CX1+(CW-LenText)/2;
Fix432.diff (943 bytes)   

alexmitin

2007-12-14 02:06

reporter   bugnote:0001034

Fixed 0000430, 0000431, 0000432.

See "Fix432.diff" file in the attachment.

vskirdin

2007-12-14 04:10

administrator   bugnote:0001035

see 391

alexmitin

2007-12-14 19:27

reporter   bugnote:0001043

Verified in 1.80.0.391.

Issue History

Date Modified Username Field Change
2007-12-12 19:42 alexmitin New Issue
2007-12-13 04:36 vskirdin Note Added: 0001027
2007-12-13 04:48 vskirdin Note Edited: 0001027
2007-12-13 10:34 vskirdin Status new => assigned
2007-12-13 10:34 vskirdin Assigned To => vskirdin
2007-12-13 10:35 vskirdin Note Added: 0001030
2007-12-13 10:35 vskirdin Status assigned => feedback
2007-12-13 21:12 samlyukov Note Added: 0001031
2007-12-14 00:41 DiRTy_GaRRy Note Added: 0001032
2007-12-14 00:45 DiRTy_GaRRy Note Added: 0001033
2007-12-14 02:03 alexmitin File Added: Fix432.diff
2007-12-14 02:06 alexmitin Note Added: 0001034
2007-12-14 04:10 vskirdin Note Added: 0001035
2007-12-14 19:27 alexmitin Status feedback => resolved
2007-12-14 19:27 alexmitin Resolution open => fixed
2007-12-14 19:27 alexmitin Note Added: 0001043
2007-12-18 03:05 vskirdin Build => 391
2007-12-18 03:05 vskirdin Status resolved => closed
2007-12-18 03:05 vskirdin Fixed in Version => 1.80 alpha 1