bezier-curve.cpp:112: When i==pts.size(), pts[i] is out of bounds

[Reijo Tomperi]

In inkscape/src/2geom/bezier-curve.cpp, there is a loop where variable "i" gets value that is equal to the size of a vector causing out of bounds situation below where pts[i] is used. (revision 10464)

BezierCurve::BezierCurve(std::vector<Point> const &pts)
{
    inner = D2<Bezier>(Bezier::Order(pts.size()-1), Bezier::Order(pts.size()-1));
    for (unsigned d = 0; d < 2; ++d) {
        for(unsigned i = 0; i <= pts.size(); i++)
            inner[d][i] = pts[i][d];
    }
}

There is no real life test case for this, this was just spotted from the code when testing Cppcheck against inkscape, but it looks quite dangerous.

[Johan Engelen (johanengelen)]

Jon, do you have commit access to lib2geom?
If not committed to 2geom, the fix will be lost upon the next update.

[ScislaC (scislac)]

Johan,

No he's not... and mgsloan and myself are still pending to get commit access. We want to help contribute. :) Johan, if you could port the change upstream that would rock (attached).

[Johan Engelen (johanengelen)]

On 19-7-2011 19:54, ScislaC wrote:
> No he's not... and mgsloan and myself are still pending to get commit
> access. We want to help contribute. :)

Hard to believe :(

I committed the fix upstream.