IntenseFinance/gnucash
3
0
Fork 0
mirror of https://github.com/Gnucash/gnucash.git synced 2025-02-25 18:55:30 -06:00
Code Issues Packages Projects Releases Wiki Activity

Bug 725054 - Re-numbering sub accounts crashes the program

Browse Source 
g_strdup_printf ("%s-%0*d", prefix, num_digits, interval) calls malloc()
with the number of required characters, which includes num_digits characters
for the numeric. If the interval is 0, log10(num_children * interval) is
log10(0), which returns NAN (not a number), which when cast to size_t is
MAXINT. That generates a malloc error, which crashes GnuCash.

So don't let the interval be 0.
This commit is contained in:
John Ralls 2014-05-27 14:15:41 -07:00
parent 75114b7c62
commit 7daad042d0
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/gnome-utils/dialog-account.c
View File

@ -1901,11 +1901,14 @@ gnc_account_renumber_update_examples (RenumberDialog *data)
{
gchar *str;
gchar *prefix;
gint interval, num_digits;
gint interval;
unsigned int num_digits = 1;
prefix = gtk_editable_get_chars(GTK_EDITABLE(data->prefix), 0, -1);
interval = gtk_spin_button_get_value_as_int(GTK_SPIN_BUTTON(data->interval));
num_digits = log10(data->num_children * interval) + 1;
if (interval <= 0)
interval = 10;
num_digits = (unsigned int)log10((double)(data->num_children * interval)) + 1;
str = g_strdup_printf("%s-%0*d", prefix, num_digits, interval);
gtk_label_set_text(GTK_LABEL(data->example1), str);
@ -1941,7 +1944,8 @@ gnc_account_renumber_response_cb (GtkDialog *dialog,
GList *children, *tmp;
gchar *str;
gchar *prefix;
gint interval, num_digits, i;
gint interval;
unsigned int num_digits, i;
if (response == GTK_RESPONSE_OK)
{
@ -1951,6 +1955,9 @@ gnc_account_renumber_response_cb (GtkDialog *dialog,
interval =
gtk_spin_button_get_value_as_int(GTK_SPIN_BUTTON(data->interval));
num_digits = log10(data->num_children * interval) + 1;
if (interval <= 0)
interval = 10;
num_digits = (unsigned int)log10 ((double)(data->num_children * interval) + 1);
gnc_set_busy_cursor (NULL, TRUE);
for (tmp = children, i = 1; tmp; tmp = g_list_next(tmp), i += 1)