[PATCH] Crash fix in add_single_dive. No writing to dive_table.dives[-1]

K. "pestophagous" Heller pestophagous at gmail.com
Wed Nov 25 10:48:29 PST 2015


On Wed, Nov 25, 2015 at 10:38 AM, Lubomir I. Ivanov <neolit123 at gmail.com> wrote:
> On 25 November 2015 at 07:26, K. "pestophagous" Heller
> <pestophagous at gmail.com> wrote:
>> Signed-off-by: K. Heller <pestophagous at gmail.com>
>> ---
>>
>> add_single_dive is called with idx = -1 in the mobile app.
>> Then a crash can happen afterward in several places
>> depending on whether the timer first triggers the QMLProfile
>> to repaint or whether QtQuick tries further interactions
>> with the DiveListModel.
>>
>> to reproduce: launch with an empty dive list (such as
>> what happens if you have no cloud account and no dives yet)
>> and then choose 'Add Dive'.
>>
>> i guess that 'Add Dive' is not necessarily supposed to be
>> working in the mobile app yet, but this crash fix seems
>> useful regardless.
>>
>>
>>  subsurface-core/divelist.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/subsurface-core/divelist.c b/subsurface-core/divelist.c
>> index a14fabf..a2e94c0 100644
>> --- a/subsurface-core/divelist.c
>> +++ b/subsurface-core/divelist.c
>> @@ -790,6 +790,9 @@ void add_single_dive(int idx, struct dive *dive)
>>         dive_table.nr++;
>>         if (dive->selected)
>>                 amount_selected++;
>> +       if (idx < 0)
>> +               // convert an idx of -1 so we do insert-at-end:
>> +               idx = dive_table.nr - 1;
>
> forgot to mention that in the above assignment dive_table.nr needs to
> be > 0, otherwise a negative index will remain.
>
> lubomir
> --

unless other code misuses dive_table, then i think we need not worry.
yet. (but i do love adding assertions...)

note that this line happens first:
  dive_table.nr++

so by the time the new code computes (dive_table.nr - 1),
dive_table.nr should be at least 1 by then. right?
/K


More information about the subsurface mailing list