[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[MiNT] Potential bug on mouse wheel



Helmut Karlowski wrote :
../c_mouse.c: In function 'cXA_wheel_event':
../c_mouse.c:623: warning: array subscript is above array bounds

That could be serious, but there is no obvious array in my sources in
that function.

It was not easy, but I finally found that array.
The functions tagged with the inline keyword are inlined with -O2, so this warning is not reported on the right line.

That array comes form the get_widget() function:
xaaes/src.km/widgets.h:96
static inline XA_WIDGET *get_widget(struct xa_window *wind, int n) { return &(wind->widgets[n]); }

Note that the second parameter n is used as subscript in the widgets array.

Now go back to xaaes/src.km/c_mouse.c, in cXA_wheel_event().
Look at the case WHL_SLDRWHEEL:
	short w = -1
followed by some tests that may affect the w variable, then:
	widg = get_widget(wind, w);

In the case where w is unmodified, get_widget() is called with n == -1, and we really do a subscript out of range.

Now I stop here.
Let's XaAES gurus continue (and provide a patch !).

--
Vincent Rivière