function nextWord() in parser.c might move the character pointer beyond the terminating zero of the string

Bug #1906996 reported by Florian Königstein
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Panotools
New
Undecided
Unassigned

Bug Description

When calling the function
void nextWord( register char* word, char** ch )
in the file parser.c with a syntactically incorrect string that begins with a " but ends
with the terminating zero (without corresponding "), the pointer *ch (and c) are moved beyond the
terminating zero of the string in the statement
        c++; // to eat last character

This bug might be a problem e.g. if a script file with the incorrect line
p f2 w3000 h1500 v360 n"TIFF_m
is parsed by ParseScript() in parser.c .

The problem can be solved by replacing this statement by
        if(0 != *c)
           c++; // to eat last character

information type: Private Security → Public
Revision history for this message
Bruno Postle (brunopostle) wrote :

Thanks, this doesn't seem to break anything, committed (this may be time for another release candidate)

Revision history for this message
Bruno Postle (brunopostle) wrote :

Hi Florian, if you are interesting in fixing other similar identified problems in libpano13, there was a thread on the hugin-ptx list prompted by some gcc warnings: https://groups.google.com/g/hugin-ptx/c/3WoY7U3HKIU/m/LyYHBvDECwAJ

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.