Package: cscope
Version: 15.5-1.1
Severity: normal
Tags: patch

This problem was found and fixed by rjr, who prefers not to post public
info about himself when submitting a bug report. I'll pass on any
correspondence.

This same bug was reported to the upstream sourceforge tracker a long
time ago, and the maintainer apparently made the fix in CVS, but has yet
to release a new version. The bug causes major and continuing
difficulties with certain patterns of usage, so it would be terrific if
it could at least be fixed in the Debian package.

cscope has a bug in handling filenames with quotes in "cscope.files"
files.

The following data file demonstrates the problem:

"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/Ufs/Windows/WindowsCreateSharedFolderPermissions.py"
"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/util/nfsd.py"
"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/util/windows_networking_subsys.py"
"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/Ufsrpc/UIInternal.py"
"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/Ufsrpc/UILogStream.py"
"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/Ufsrpc/UIWindows.py"
"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/IsilonUI/Launch.py"
"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/patches/WDGValidator.py"
"/home/anon/cvs/stuff/src/include/arpa/nameser.h"
"/home/anon/cvs/stuff/src/include/arpa/ftp.h"
"/home/anon/cvs/stuff/src/include/arpa/inet.h"
"/home/anon/cvs/stuff/src/include/arpa/nameser_compat.h"
"/home/anon/cvs/stuff/src/include/arpa/telnet.h"
"/home/anon/cvs/stuff/src/include/arpa/tftp.h"
"/home/anon/cvs/stuff/src/include/a.out.h"
"/home/anon/cvs/stuff/src/include/ar.h"
"/home/anon/cvs/stuff/src/include/assert.h"
"/home/anon/cvs/stuff/src/include/bitstring.h"
"/home/anon/cvs/stuff/src/include/complex.h"
"/home/anon/cvs/stuff/src/include/ctype.h"
"/home/anon/cvs/stuff/src/include/db.h"
"/home/anon/cvs/stuff/src/include/dirent.h"
"/home/anon/cvs/stuff/src/include/disktab.h"
"/home/anon/cvs/stuff/src/include/dlfcn.h"
"/home/anon/cvs/stuff/src/include/elf-hints.h"
"/home/anon/cvs/stuff/src/include/elf.h"
"/home/anon/cvs/stuff/src/include/err.h"

What happens is this:

"/home/anon/cvs/stuff/src/mycode/scripts/cmd_webui/Ufs/Windows/WindowsCreateSharedFolderPermissions.py"

gets into the buffer 'line' and then a pointer ('point_in_line') gets
set to the current location in the line. The code notes that this line
has quotes on it so it tries to remove them, but in the process it moves
the point_in_line pointer to the location of the closing quotation mark.
However, at the end of the sscanf() loop we again update the
point_in_line pointer to +length_of_name. This ends up pointing off into
a random location in 'line' (fortunately, this buffer is quite large).

Later on we read in a shorter string. For example

"/home/anon/cvs/stuff/src/include/ar.h"

We again remove the quotes and increment, but on the
second increment we end up pointing at a portion of the
old long string and on the next pass at sscanf(), we
end up with something like

point_in_line = erPermissions.py"

which is not a valid file, resulting in

"cscope: cannot find file erPermissions.py""

The patch for this problem is attached.

-- 
paul

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.10-1-686
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages cscope depends on:
ii  libc6                       2.3.2.ds1-20 GNU C Library: Shared libraries an
ii  libncurses5                 5.4-4        Shared libraries for terminal hand

-- no debconf information
--- cscope-15.5/src/dir.c	2003-06-02 04:43:00.000000000 -0600
+++ dir.c	2004-06-22 16:40:26.056658100 -0600
@@ -401,6 +401,9 @@
 							newpath[out] = '\0';
 							/* Make sure we skip over the part just read */
 							point_in_line += in + 1;
+							/* Don't move point_in_line at the end of this loop!
+							 * I'm sure there's a better fix for this. */
+							length_of_name = 0;
 							/* ... to deactive step by strlen() path at end
 							 * of loop */
 							path[0]='\0';

Reply via email to