Bug 534694 – Col id in GtkListStore could be out of range

2008-05-25  Matthias Clasen  <mclasen@redhat.com>

        Bug 534694 – Col id in GtkListStore could be out of range

        * gtk/gtkliststore.c (list_store_start_element): Fix up error handling
        a bit. Pointed out by Jan Arne Petersen.

svn path=/trunk/; revision=20157

diff --git a/ChangeLog b/ChangeLog
index 121b0f0503f29655cb1bd7740411e4406764b60c..0dc992ef35d3b7e8ce114a5e5214c4bed499b397 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2008-05-25  Matthias Clasen  <mclasen@redhat.com>
+
+       Bug 534694 – Col id in GtkListStore could be out of range
+
+       * gtk/gtkliststore.c (list_store_start_element): Fix up error handling
+       a bit. Pointed out by Jan Arne Petersen.
+
 2008-05-25  Matthias Clasen  <mclasen@redhat.com>
 
        Bug 532497 – Configure problem when cross-compiling

diff --git a/gtk/gtkliststore.c b/gtk/gtkliststore.c
index b1e3ba5ee1c326b8b1e56f72d36506a658be5b32..f71836e1c31e77a4166aa2cd4fe1a64a5de63819 100644 (file)
--- a/gtk/gtkliststore.c
+++ b/gtk/gtkliststore.c
@@ -2084,8 +2084,11 @@ list_store_start_element (GMarkupParseContext *context,
       ColInfo *info;
 
       if (data->row_column >= data->n_columns)
-       g_set_error (error, data->error_quark, 0,
-                    "Too many columns, maximum is %d\n", data->n_columns - 1);
+        {
+         g_set_error (error, data->error_quark, 0,
+                      "Too many columns, maximum is %d\n", data->n_columns - 1);
+          return;
+        }
 
       for (i = 0; names[i]; i++)
        if (strcmp (names[i], "id") == 0)
@@ -2093,9 +2096,18 @@ list_store_start_element (GMarkupParseContext *context,
            errno = 0;
            id = atoi (values[i]);
            if (errno)
-             g_set_error (error, data->error_quark, 0,
-                          "the id tag %s could not be converted to an integer",
-                          values[i]);
+              {
+               g_set_error (error, data->error_quark, 0,
+                            "the id tag %s could not be converted to an integer",
+                            values[i]);
+                return;
+              }
+           if (id < 0 || id >= data->n_columns)
+              {
+                g_set_error (error, data->error_quark, 0,
+                             "id value %d out of range", id);
+                return;
+              }
          }
        else if (strcmp (names[i], "translatable") == 0)
          {
@@ -2113,8 +2125,11 @@ list_store_start_element (GMarkupParseContext *context,
          }
 
       if (id == -1)
-       g_set_error (error, data->error_quark, 0,
-                    "<col> needs an id attribute");
+        {
+         g_set_error (error, data->error_quark, 0,
+                      "<col> needs an id attribute");
+          return;
+        }
       
       info = g_slice_new0 (ColInfo);
       info->translatable = translatable;