Subject: lib/17612: libcdk, newCDKRadio needs better param checking - segvs
To: None <gnats-bugs@gnats.netbsd.org>
From: None <rtr@wasabisystems.com>
List: netbsd-bugs
Date: 07/17/2002 12:23:21
>Number: 17612
>Category: lib
>Synopsis: libcdk, CDKRADIO allows improper params, resulting in segv.
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: lib-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Tue Jul 16 09:19:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator: Tyler Retzlaff
>Release: NetBSD 1.6D
>Organization:
Wasabi Systems
>Environment:
System: NetBSD elysium 1.6D NetBSD 1.6D (elysium) #0: Mon Jul 15 06:43:10 EST 2002 rtr@elysium:/usr/src/sys/arch/i386/compile/elysium i386
Architecture: i386
Machine: i386
>Description:
newCDKRadio() does not properly check parameters to ensure they aren't
illegal.
>How-To-Repeat:
radio = newCDKRadio(scr, CENTER, CENTER, NONE, 1, 6, "", items, 1, 'X',
1, A_REVERSE, FALSE, FALSE);
Attempting to call activateCDKRadio() on this radio will result in
a segv as long as parameter 5 is < 4.
I assume the problem occurs because newCDKRadio does not properly
calculate the height of the box lines + title + shadow + elements.
>Fix:
No time to fix, so no suggestions. If this PR lingers I'l come back
to and try to fix it.
I would however suggest doing some magic on the value passed in
so that passing values > 0 don't cause a fault.
>Release-Note:
>Audit-Trail:
>Unformatted: