mc-4.6.0-pre3 (and earlier) bug?

Pavel Roskin proski at gnu.org
Thu Jan 23 14:20:48 UTC 2003


Hello!

> > It's a serious bug in the S-Lang library.  Function send_attr_str
> > overwrites the stack and then crashes:
>
>  Someone thought 256 will be enough for everyone. Someone was wrong :)
>
>    #if !defined(__MSDOS_16BIT__)
>    # define MAX_SCREEN_SIZE 256

That's actually for the rows (horizontal lines).  The problem in
send_attr_str() is due too many columns (vertical lines).  The "out" array
is 256 bytes long, so it gets overfilled.

I've applied a patch to slint.c to limit the screen size to 255x255.  mc
works fine at 255x255.

-- 
Regards,
Pavel Roskin



More information about the mc-devel mailing list