Array out of bounds in Icon preview dialog

[Peter Clifton]

Binary package hint: inkscape

sizes array is 5 long, a typo causes us to write off the end. (If no sizes were loaded from the preferences file).

diff -urNad inkscape-0.45.1~/src/dialogs/iconpreview.cpp inkscape-0.45.1/src/dialogs/iconpreview.cpp
--- inkscape-0.45.1~/src/dialogs/iconpreview.cpp 2007-12-22 17:14:55.000000000 +0000
+++ inkscape-0.45.1/src/dialogs/iconpreview.cpp 2007-12-22 17:20:30.000000000 +0000
@@ -130,7 +130,7 @@
         sizes[1] = 24;
         sizes[2] = 32;
         sizes[3] = 48;
- sizes[5] = 128;
+ sizes[4] = 128;
     }

     pixMem = new guchar*[numEntries];

Impact: A 5 element array is having a 6th element referenced, causing an out of bounds error. This issue may occur if the user has made certain modifications to their preferences.

Addressed upstream: The above patch has been committed to upstream's development branch.

Patch proposed: The above 1-line patch addresses the issue

Regression potential: None. Logic comes into play only when user has customized their preferences file beyond the default.

[Bryce Harrington (bryce)]

Fix has been committed upstream. Not sure it's critical enough to warrant an SRU though.

[Kees Cook (kees)]

Anyone that wants to drive this SRU will need to clean up the debdiff (see bug 113980) to exclude all the generated autoconf files and include a testcase in the description. Marking as "Won't Fix" for now.

[Emmet Hikory (persia)]

Note that the current inkscape debian/rules causes the autoconf mess as part of the clean rule. cleaning up the debdiff would only be a visual improvement, and it would all return when regenerated by the uploader.

In previous cases, it was considered better to leave the generated files there as it reduces the invasiveness of the patch. Separately, inkscape should be adjusted to not dirty the source in clean (if automating the hint file updates, this should be done in config.status:)