-
-
Notifications
You must be signed in to change notification settings - Fork 259
Open
Description
I have found an invalid read during table rendering with valgrind:
==367320== Invalid read of size 4
==367320== at 0x387F40: litehtml::render_item_table::_render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320== by 0x379C4E: litehtml::render_item::render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320== by 0x3B2476: litehtml::render_item_block_context::_render_content(int, int, bool, litehtml::containing_block_context const&, litehtml::formatting_context*) (in build/Release/bl_litehtml_demo)
==367320== by 0x384518: litehtml::render_item_block::_render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320== by 0x379C4E: litehtml::render_item::render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320== by 0x3B2476: litehtml::render_item_block_context::_render_content(int, int, bool, litehtml::containing_block_context const&, litehtml::formatting_context*) (in build/Release/bl_litehtml_demo)
==367320== by 0x384518: litehtml::render_item_block::_render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320== by 0x379C4E: litehtml::render_item::render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320== by 0x3B2476: litehtml::render_item_block_context::_render_content(int, int, bool, litehtml::containing_block_context const&, litehtml::formatting_context*) (in build/Release/bl_litehtml_demo)
==367320== by 0x384518: litehtml::render_item_block::_render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320== by 0x379C4E: litehtml::render_item::render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320== by 0x3B2476: litehtml::render_item_block_context::_render_content(int, int, bool, litehtml::containing_block_context const&, litehtml::formatting_context*) (in build/Release/bl_litehtml_demo)
==367320== Address 0x11ae626c is 4 bytes before a block of size 288 alloc'd
==367320== at 0x4840EB4: operator new(unsigned long) (m_replacemalloc/vg_replace_malloc.c:487)
==367320== by 0x3AFC07: void std::vector<litehtml::table_column, std::allocator<litehtml::table_column> >::_M_realloc_append<int, int>(int&&, int&&) (in build/Release/bl_litehtml_demo)
==367320== by 0x3AD9ED: litehtml::table_grid::finish() (in build/Release/bl_litehtml_demo)
==367320== by 0x388ABE: litehtml::render_item_table::init() (in build/Release/bl_litehtml_demo)
==367320== by 0x383F74: litehtml::render_item_block::init() (in build/Release/bl_litehtml_demo)
==367320== by 0x383F74: litehtml::render_item_block::init() (in build/Release/bl_litehtml_demo)
==367320== by 0x383F74: litehtml::render_item_block::init() (in build/Release/bl_litehtml_demo)
==367320== by 0x383F74: litehtml::render_item_block::init() (in build/Release/bl_litehtml_demo)
==367320== by 0x322466: litehtml::document::createFromString(litehtml::estring const&, litehtml::document_container*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (in build/Release/bl_litehtml_demo)
==367320== by 0x13253F: BLLiteHtmlDocument::createFromHTML(BLArrayView<char>, BLArrayView<char>) (in build/Release/bl_litehtml_demo)
==367320== by 0x1322CC: BLLiteHtmlDocument::createFromURL(BLArrayView<char>, BLArrayView<char>) (in build/Release/bl_litehtml_demo)
==367320== by 0x13434B: BLLiteHtmlView::mouseReleaseEvent(QMouseEvent*) (in build/Release/bl_litehtml_demo)
==367320==
This is the corresponding line in the code:
int cell_width = m_grid->column(span_col).right - m_grid->column(col).left;
This implies that span_col
must be -1
after int span_col = col + cell->colspan - 1;
.
Metadata
Metadata
Assignees
Labels
No labels