Skip to content

A possible bug in render_item_table::_render() #358

@kobalicek

Description

@kobalicek

I have found an invalid read during table rendering with valgrind:

==367320== Invalid read of size 4
==367320==    at 0x387F40: litehtml::render_item_table::_render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320==    by 0x379C4E: litehtml::render_item::render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320==    by 0x3B2476: litehtml::render_item_block_context::_render_content(int, int, bool, litehtml::containing_block_context const&, litehtml::formatting_context*) (in build/Release/bl_litehtml_demo)
==367320==    by 0x384518: litehtml::render_item_block::_render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320==    by 0x379C4E: litehtml::render_item::render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320==    by 0x3B2476: litehtml::render_item_block_context::_render_content(int, int, bool, litehtml::containing_block_context const&, litehtml::formatting_context*) (in build/Release/bl_litehtml_demo)
==367320==    by 0x384518: litehtml::render_item_block::_render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320==    by 0x379C4E: litehtml::render_item::render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320==    by 0x3B2476: litehtml::render_item_block_context::_render_content(int, int, bool, litehtml::containing_block_context const&, litehtml::formatting_context*) (in build/Release/bl_litehtml_demo)
==367320==    by 0x384518: litehtml::render_item_block::_render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320==    by 0x379C4E: litehtml::render_item::render(int, int, litehtml::containing_block_context const&, litehtml::formatting_context*, bool) (in build/Release/bl_litehtml_demo)
==367320==    by 0x3B2476: litehtml::render_item_block_context::_render_content(int, int, bool, litehtml::containing_block_context const&, litehtml::formatting_context*) (in build/Release/bl_litehtml_demo)


==367320==  Address 0x11ae626c is 4 bytes before a block of size 288 alloc'd
==367320==    at 0x4840EB4: operator new(unsigned long) (m_replacemalloc/vg_replace_malloc.c:487)
==367320==    by 0x3AFC07: void std::vector<litehtml::table_column, std::allocator<litehtml::table_column> >::_M_realloc_append<int, int>(int&&, int&&) (in build/Release/bl_litehtml_demo)
==367320==    by 0x3AD9ED: litehtml::table_grid::finish() (in build/Release/bl_litehtml_demo)
==367320==    by 0x388ABE: litehtml::render_item_table::init() (in build/Release/bl_litehtml_demo)
==367320==    by 0x383F74: litehtml::render_item_block::init() (in build/Release/bl_litehtml_demo)
==367320==    by 0x383F74: litehtml::render_item_block::init() (in build/Release/bl_litehtml_demo)
==367320==    by 0x383F74: litehtml::render_item_block::init() (in build/Release/bl_litehtml_demo)
==367320==    by 0x383F74: litehtml::render_item_block::init() (in build/Release/bl_litehtml_demo)
==367320==    by 0x322466: litehtml::document::createFromString(litehtml::estring const&, litehtml::document_container*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (in build/Release/bl_litehtml_demo)
==367320==    by 0x13253F: BLLiteHtmlDocument::createFromHTML(BLArrayView<char>, BLArrayView<char>) (in build/Release/bl_litehtml_demo)
==367320==    by 0x1322CC: BLLiteHtmlDocument::createFromURL(BLArrayView<char>, BLArrayView<char>) (in build/Release/bl_litehtml_demo)
==367320==    by 0x13434B: BLLiteHtmlView::mouseReleaseEvent(QMouseEvent*) (in build/Release/bl_litehtml_demo)
==367320== 

This is the corresponding line in the code:

 int cell_width = m_grid->column(span_col).right - m_grid->column(col).left;

This implies that span_col must be -1 after int span_col = col + cell->colspan - 1;.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions