I think the patch below, which I have just applied to Ubuntu Breezy's
fontforge, fixes this crash.

--- ../orig/fontforge-0.0.20041218/fontforge-20041218/mensis/scripting.c        
2003-10-16 00:51:37.000000000 +0100
+++ fontforge-20041218/mensis/scripting.c       2005-09-15 19:27:24.000000000 
+0100
@@ -2196,7 +2196,7 @@
                strcat(ret,temp);
                if ( other.type==v_str ) free(other.u.sval);
                free(val->u.lval->u.sval);
-               val->u.sval = ret;
+               val->u.lval->u.sval = ret;
            } else
                error( c, "Invalid types in assignment");
        }
--- ../orig/fontforge-0.0.20041218/fontforge-20041218/fontforge/scripting.c     
2004-12-12 21:30:41.000000000 +0000
+++ fontforge-20041218/fontforge/scripting.c    2005-09-15 19:17:38.000000000 
+0100
@@ -5384,7 +5384,7 @@
                strcat(ret,temp);
                if ( other.type==v_str ) free(other.u.sval);
                free(val->u.lval->u.sval);
-               val->u.sval = ret;
+               val->u.lval->u.sval = ret;
            } else
                error( c, "Invalid types in assignment");
        }

Due to the insane build system, this turns out to look more like this:

diff -u fontforge-0.0.20041218/debian/control 
fontforge-0.0.20041218/debian/control
--- fontforge-0.0.20041218/debian/control
+++ fontforge-0.0.20041218/debian/control
@@ -2,7 +2,7 @@
 Section: x11
 Priority: optional
 Maintainer: Chanop Silpa-Anan <[EMAIL PROTECTED]>
-Build-Depends: debhelper (>= 4.0.0), libjpeg62-dev, libtiff4-dev, libpng3-dev, 
 libungif4-dev, xlibs-dev, libfreetype6-dev, patch, autoconf, autotools-dev, 
autoconf, automake1.7, libtool
+Build-Depends: debhelper (>= 4.0.0), libjpeg62-dev, libtiff4-dev, libpng3-dev, 
 libungif4-dev, xlibs-dev, libfreetype6-dev, patch, autoconf, autotools-dev, 
autoconf, automake1.7, libtool, bzip2
 Standards-Version: 3.6.1
 
 Package: fontforge
diff -u fontforge-0.0.20041218/debian/changelog 
fontforge-0.0.20041218/debian/changelog
--- fontforge-0.0.20041218/debian/changelog
+++ fontforge-0.0.20041218/debian/changelog
@@ -1,3 +1,17 @@
+fontforge (0.0.20041218-0.1ubuntu3) breezy; urgency=low
+
+  * Fix crashing bug in string += operation.  Ubuntu 14759,
+    Debian #326788.
+
+ -- Ian Jackson <[EMAIL PROTECTED]>  Thu, 15 Sep 2005 19:29:59 +0100
+
+fontforge (0.0.20041218-0.1ubuntu2) unstable; urgency=low
+
+  * Add bzip2 to build-depends.  (Same fix as to Debian #326225,
+    which is included in latest Debian.  Bugzilla 14567.)
+
+ -- Ian Jackson <[EMAIL PROTECTED]>  Wed,  7 Sep 2005 18:52:46 +0100
+
 fontforge (0.0.20041218-0.1ubuntu1) hoary; urgency=low
 
   * Resynchronise with Debian.
diff -u fontforge-0.0.20041218/debian/rules fontforge-0.0.20041218/debian/rules
--- fontforge-0.0.20041218/debian/rules
+++ fontforge-0.0.20041218/debian/rules
@@ -14,7 +14,7 @@
 
 
 
-CFLAGS = -O2
+CFLAGS = -O0
 INSTALL = install
 INSTALL_FILE    = $(INSTALL) -p    -o root -g root  -m  644
 INSTALL_PROGRAM = $(INSTALL) -p    -o root -g root  -m  755
only in patch2:
unchanged:
--- 
fontforge-0.0.20041218.orig/debian/fontforge-patches/009_scripting_stringplusassign_crash.diff
+++ 
fontforge-0.0.20041218/debian/fontforge-patches/009_scripting_stringplusassign_crash.diff
@@ -0,0 +1,22 @@
+--- ../orig/fontforge-0.0.20041218/fontforge-20041218/mensis/scripting.c       
2003-10-16 00:51:37.000000000 +0100
++++ fontforge-20041218/mensis/scripting.c      2005-09-15 19:27:24.000000000 
+0100
+@@ -2196,7 +2196,7 @@
+               strcat(ret,temp);
+               if ( other.type==v_str ) free(other.u.sval);
+               free(val->u.lval->u.sval);
+-              val->u.sval = ret;
++              val->u.lval->u.sval = ret;
+           } else
+               error( c, "Invalid types in assignment");
+       }
+--- ../orig/fontforge-0.0.20041218/fontforge-20041218/fontforge/scripting.c    
2004-12-12 21:30:41.000000000 +0000
++++ fontforge-20041218/fontforge/scripting.c   2005-09-15 19:17:38.000000000 
+0100
+@@ -5384,7 +5384,7 @@
+               strcat(ret,temp);
+               if ( other.type==v_str ) free(other.u.sval);
+               free(val->u.lval->u.sval);
+-              val->u.sval = ret;
++              val->u.lval->u.sval = ret;
+           } else
+               error( c, "Invalid types in assignment");
+       }

A change like this is already in 0.0.20050911-1 so there is no need to
report it upstream and the change is probably safe.

Ian.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Reply via email to