[Adium-devl] Random log viewer crash... and probably others

Evan Schoenberg evan at adiumx.com
Sat Jun 17 23:40:21 UTC 2006


Found it, I believe.  Memory stomping, indeed.

AITableViewAdditions's - (NSArray *) 
arrayOfSelectedItemsUsingSourceArray:(NSArray *)sourceArray
and the not-used-here but used elsewhere and probably responsible for  
other random crashes,
AIOutlineViewAdditions' - (NSArray *)arrayOfSelectedItems

	unsigned int *buf = malloc(bufSize + sizeof(unsigned int));

see anything ugly?

	unsigned int *buf = malloc(bufSize * sizeof(unsigned int));

is how it should look. Following that by
	[indices getIndexes:buf maxCount:bufSize inIndexRange:&range];
means that we were asking NSIndexSet to overwrite random memory we  
didn't malloc in the first place. Fun!

-Evan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://adium.im/pipermail/devel_adium.im/attachments/20060617/f4f78b36/attachment-0001.html>


More information about the devel mailing list