You are viewing a plain text version of this content. The canonical link for it is here.
Posted to batik-dev@xmlgraphics.apache.org by bu...@apache.org on 2006/06/19 22:12:46 UTC
DO NOT REPLY [Bug 39838] New: - patches to prevent integer overflow
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39838>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39838
Summary: patches to prevent integer overflow
Product: Batik
Version: 1.6
Platform: All
OS/Version: All
Status: NEW
Severity: minor
Priority: P2
Component: Utilities
AssignedTo: batik-dev@xmlgraphics.apache.org
ReportedBy: info@dvholten.de
after the recent 'buhei' about the buggy binary search in the jdk (see
javalobby.org i decided to check the batik-source for similar 'sleepers'.
I dont think that this is an urgent work to prevent immediate problems, but...
someone stepped on the that bug and reported in sun's bugbase.
If a problem is so easy to wipe out, it should be done.
The problem with binary search and those i fixed in the attached patches is
something like this:
mid = (low + high) / 2; // java.util
or // in batik
newSize = ( size * 3 ) >> 2; // that is: (size * 3) / 4 = 0.75
the intermediate result of ( size * 3) may overflow to negative and causing
problems later on.
The cure is to rewrite the expression in an 'overflow-avoiding' way:
newSize = ( size - ( size >> 2 )); // that is ( size - size/4) = 0.75
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: batik-dev-unsubscribe@xmlgraphics.apache.org
For additional commands, e-mail: batik-dev-help@xmlgraphics.apache.org
Re: DO NOT REPLY [Bug 39838] New: - patches to prevent integer overflow
Posted by Cameron McCormack <ca...@mcc.id.au>.
Jeremias Maerki:
> Doesn't hurt. :-) I guess we will need one for XML Graphics Commons
> unless we want a wide range of styles. But even in FOP we haven't fixed
> all style "violations", yet.
Yeah, style is one of those things where I think, idealistcally,
everyone can have their own style and an automatic reformatter to put
the code back into whatever form is chosen for the repository. But in
reality, people don’t do that, and when I see code that clearly goes
against my personal style I get slightly perturbed. ;-)
--
Cameron McCormack, http://mcc.id.au/
xmpp:heycam@jabber.org ▪ ICQ 26955922 ▪ MSN cam@mcc.id.au
---------------------------------------------------------------------
To unsubscribe, e-mail: batik-dev-unsubscribe@xmlgraphics.apache.org
For additional commands, e-mail: batik-dev-help@xmlgraphics.apache.org
Re: DO NOT REPLY [Bug 39838] New: - patches to prevent integer overflow
Posted by Jeremias Maerki <de...@jeremias-maerki.ch>.
On 20.06.2006 15:15:09 Cameron McCormack wrote:
> Jeremias Maerki:
> > you are now a committer in Batik. You can apply these changes yourself
> > if you think they don't need to be discussed (commit-review). The
> > approach you've chosen is only necessary if you have a change that could
> > be subject for discussion (review-commit).
>
> Oh and another thing I meant to mention, Dieter. Any file that you make
> any changes to (that arent trivial reformatting or something similarly
> small) should have its copyright message updated so that the current
> year is included.
Actually, that's not important anymore. Shortly, there will be an
announcement about a policy change concerning the license header. It
will be changed again and the new one will not have a copyright year
anymore. Cliff Schmidt (ASF VP, legal affairs) is currently finalizing
all necessary information. Stay tuned.
> One thing in the code:
>
> Index: org/apache/batik/css/engine/StringIntMap.java
>
> - if (count++ >= (len * 3) >>> 2) {
> + if (count++ >= len - ( len >>> 2 )) {
>
> Note that these two expressions are slightly different. For example
> when len == 5, the first expression checks >= 3, while the second checks
> >= 4. It doesnt really matter in this case, though, since its just
> used as a rough check for when the hash table is getting full. If you
> realised this, dont mind me.
>
> Thinking aloud: should we have a code style policy, as FOP does?
Doesn't hurt. :-) I guess we will need one for XML Graphics Commons
unless we want a wide range of styles. But even in FOP we haven't fixed
all style "violations", yet.
Jeremias Maerki
---------------------------------------------------------------------
To unsubscribe, e-mail: batik-dev-unsubscribe@xmlgraphics.apache.org
For additional commands, e-mail: batik-dev-help@xmlgraphics.apache.org
Re: DO NOT REPLY [Bug 39838] New: - patches to prevent integer overflow
Posted by Cameron McCormack <ca...@mcc.id.au>.
Jeremias Maerki:
> you are now a committer in Batik. You can apply these changes yourself
> if you think they don't need to be discussed (commit-review). The
> approach you've chosen is only necessary if you have a change that could
> be subject for discussion (review-commit).
Oh and another thing I meant to mention, Dieter. Any file that you make
any changes to (that aren’t trivial reformatting or something similarly
small) should have its copyright message updated so that the current
year is included.
One thing in the code:
Index: org/apache/batik/css/engine/StringIntMap.java
…
- if (count++ >= (len * 3) >>> 2) {
+ if (count++ >= len - ( len >>> 2 )) {
Note that these two expressions are slightly different. For example
when len == 5, the first expression checks >= 3, while the second checks
>= 4. It doesn’t really matter in this case, though, since it’s just
used as a rough check for when the hash table is getting full. If you
realised this, don’t mind me.
Thinking aloud: should we have a code style policy, as FOP does?
--
Cameron McCormack, http://mcc.id.au/
xmpp:heycam@jabber.org ▪ ICQ 26955922 ▪ MSN cam@mcc.id.au
---------------------------------------------------------------------
To unsubscribe, e-mail: batik-dev-unsubscribe@xmlgraphics.apache.org
For additional commands, e-mail: batik-dev-help@xmlgraphics.apache.org
Re: DO NOT REPLY [Bug 39838] New: - patches to prevent integer overflow
Posted by Jeremias Maerki <de...@jeremias-maerki.ch>.
Dieter,
you are now a committer in Batik. You can apply these changes yourself
if you think they don't need to be discussed (commit-review). The
approach you've chosen is only necessary if you have a change that could
be subject for discussion (review-commit).
If you have trouble with write-access to the SVN repository or need to
know about anything else, please don't hesitate to ask. This project
lives not only from code contributions but also from one helping the
other. And many other things, of course... :-)
New committers guide:
http://www.apache.org/dev/new-committers-guide.html
You now have new privileges in this project. Use them to help improve
Batik.
On 19.06.2006 22:12:46 bugzilla wrote:
> DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG·
> RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
> <http://issues.apache.org/bugzilla/show_bug.cgi?id=39838>.
> ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND·
> INSERTED IN THE BUG DATABASE.
>
> http://issues.apache.org/bugzilla/show_bug.cgi?id=39838
>
> Summary: patches to prevent integer overflow
> Product: Batik
> Version: 1.6
> Platform: All
> OS/Version: All
> Status: NEW
> Severity: minor
> Priority: P2
> Component: Utilities
> AssignedTo: batik-dev@xmlgraphics.apache.org
> ReportedBy: info@dvholten.de
>
>
> after the recent 'buhei' about the buggy binary search in the jdk (see
> javalobby.org i decided to check the batik-source for similar 'sleepers'.
> I dont think that this is an urgent work to prevent immediate problems, but...
> someone stepped on the that bug and reported in sun's bugbase.
> If a problem is so easy to wipe out, it should be done.
> The problem with binary search and those i fixed in the attached patches is
> something like this:
> mid = (low + high) / 2; // java.util
> or // in batik
> newSize = ( size * 3 ) >> 2; // that is: (size * 3) / 4 = 0.75
> the intermediate result of ( size * 3) may overflow to negative and causing
> problems later on.
> The cure is to rewrite the expression in an 'overflow-avoiding' way:
> newSize = ( size - ( size >> 2 )); // that is ( size - size/4) = 0.75
>
> --
> Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
> ------- You are receiving this mail because: -------
> You are the assignee for the bug, or are watching the assignee.
Jeremias Maerki
---------------------------------------------------------------------
To unsubscribe, e-mail: batik-dev-unsubscribe@xmlgraphics.apache.org
For additional commands, e-mail: batik-dev-help@xmlgraphics.apache.org
DO NOT REPLY [Bug 39838] - patches to prevent integer overflow
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39838>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39838
------- Additional Comments From info@dvholten.de 2006-06-19 20:21 -------
Created an attachment (id=18488)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=18488&action=view)
fixes to prevent integer-overflow
patched files are:
o.a.b.bridge.UpdateManager.java
o.a.b.css.engine.StringIntMap.java, StringMap,
o.a.b.dom.util.TriplyIndexTable.java HashTable.java
o.a.b.dom.AbstractElement.java
o.a.b.ext.awt.geom.PathLength.java
o.a.b.ext.awt.image.codec.png.PNGImageDecoder.java, PNGRed.java,
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: batik-dev-unsubscribe@xmlgraphics.apache.org
For additional commands, e-mail: batik-dev-help@xmlgraphics.apache.org
DO NOT REPLY [Bug 39838] - patches to prevent integer overflow
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39838>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39838
info@dvholten.de changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
------- Additional Comments From info@dvholten.de 2007-01-24 09:52 -------
these and other fixes have been applied - bug declared closed.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: batik-dev-unsubscribe@xmlgraphics.apache.org
For additional commands, e-mail: batik-dev-help@xmlgraphics.apache.org