Package: lpe
Version: 1.2.6.12
Severity: important
Tags: patch

lpe crashes  with sig11 on amd64 when trying to save a buffer to file,
thus rendering it useless on x86-64-systems.

Analyzing the coredump with gdb shows that save_buffer from buffer.c
calls sprintf with the two functions basename and dirname.

At least one of them is erroneous, however, I do not see why one should
concatenate the output of dirname($filename) with basename($filename)
(resulting in $filename itself), so I replaced these two function-
calls with a simple reference to $file (this is buf->fname).

The attached patch fixes the sig11 on amd64.

Note: I'm using my normal i386-system for reporting this bug as the
      amd64-system is unable to send mail.


-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (900, 'testing'), (50, 'unstable')
Architecture: i386 (i586)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.11
Locale: LANG=C, LC_CTYPE=de_DE (charmap=ISO-8859-1)

Versions of packages lpe depends on:
ii  libc6                       2.3.2.ds1-22 GNU C Library: Shared libraries an
ii  libncurses5                 5.4-9        Shared libraries for terminal hand
ii  libslang2                   2.0.4-2      The S-Lang programming library - r

lpe recommends no packages.

-- no debconf information
diff -u -r lpe-1.2.6.11/src/buffer.c lpe-new/src/buffer.c
--- lpe-1.2.6.11/src/buffer.c   2004-07-24 01:00:26.000000000 +0200
+++ lpe-new/src/buffer.c        2005-09-23 01:42:06.000000000 +0200
@@ -550,7 +550,9 @@
      */
     strcpy(dir, buf->fname);
     strcpy(file,buf->fname);
-    sprintf(bakname,"%s/.%s.lpe",dirname(dir),basename(file));
+    if ((buf->fname) != NULL) {
+       snprintf(bakname, sizeof(bakname), "%s.lpe", file);
+    }
     if(copy(buf->fname,bakname) != 0)
         copied = 0;
     fp = fopen (buf->fname, "w");

Reply via email to