[bug #62243] do_search_replace in src/ui/texteditors.c reads uninitialized memory

[anonymous]

URL:
  <https://savannah.gnu.org/bugs/?62243>

                 Summary: do_search_replace in src/ui/texteditors.c reads
uninitialized memory
                 Project: Denemo
            Submitted by: None
            Submitted on: Thu 31 Mar 2022 10:00:11 PM UTC
                Category: None
                Severity: 3 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
         Originator Name: 
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:

The function `do_search_replace` declares the variable `flags` for both GTK2
and GTK3 and lets the function `search_dialog` initialize the value of
`flags`.


static void
do_search_replace (GtkTextView * view, gboolean replace)
{
  GtkTextBuffer *buffer = gtk_text_view_get_buffer (view);
  GtkTextIter iter;
  char *what, *replacement;
#if GTK_MAJOR_VERSION==3
  GtkTextSearchFlags flags;  // DECLARED HERE
#else
  GtkSourceSearchFlags flags;  // DECLARED HERE
#endif

  // 'flags' INITIALIZED IN FUNCTION BELOW
  if (!search_dialog (GTK_WIDGET (view), replace, &what, &replacement,
&flags))
    return;

  if (replace)
    {
      gtk_text_buffer_get_iter_at_offset (buffer, &iter, 0);

      while (TRUE)
        {
          GtkTextIter match_start, match_end;
#if GTK_MAJOR_VERSION==3
          // USED HERE UNITIALIZED
          if (!gtk_text_iter_forward_search (&iter, what, flags, &match_start,
&match_end, NULL))
#else


But `search_dialog` only initializes the value in GTK2, so when compiling with
GTK3, `flags` is just some initialized value.


#if GTK_MAJOR_VERSION==3
static gboolean
search_dialog (GtkWidget * widget, gboolean replace, char **what_p, char
**replacement_p, GtkTextSearchFlags * flags_p)
#else
static gboolean
search_dialog (GtkWidget * widget, gboolean replace, char **what_p, char
**replacement_p, GtkSourceSearchFlags * flags_p)
#endif
{
  // [removed other code]
#if GTK_MAJOR_VERSION==2
  *flags_p = search_data.flags = gtk_toggle_button_get_active (case_sensitive)
? 0 : GTK_SOURCE_SEARCH_CASE_INSENSITIVE;
#endif
  gtk_widget_destroy (dialog);
  return TRUE;
}


This seems to happen in master (and the latest release in Ubuntu).




    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?62243>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/