A potential bug of use of uninitialised variable

Bug #1813556 reported by Rongxin
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
htop
New
Unknown
htop (Ubuntu)
Fix Released
Low
Unassigned

Bug Description

Please refer to the git repository of htop, the bug is https://github.com/hishamhm/htop/issues/882

In InfoScreen.c file, there is a potential use of uninitialised variable bug. In Line 133, it calls the function getmouse(&mevent) and mevent may be uninitialised after the function return. As we can see below, the library function getmouse would return ERR without initialising its parameter aevent (when the path condition at Line 1761-1764 is false, it will directly return ERR and not initialise aevent). Then, in the file InfoScreen.c, at Line 133, the path condition is false, and the Line 133-136 will not be executed. However, the Line 137, "if (mevent.y == LINES - 1)" will be executed, and mevent.y is not initialised at all. I guess there is a missing "else" in Line 137, which is the root cause of this bug.

Revision history for this message
Rongxin (wurongxin1987) wrote :
Revision history for this message
Rongxin (wurongxin1987) wrote :
information type: Private Security → Public Security
Changed in htop (Ubuntu):
status: New → Confirmed
Changed in htop:
status: Unknown → New
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Thanks for opening the upstream issue as well, it is sad that no one there is replying or merging your change as the preferred way would be to grab a new version of it.

Changed in htop (Ubuntu):
importance: Undecided → Low
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

I pinged the upstream bug as well, lets see ...

Revision history for this message
Graham Inggs (ginggs) wrote :

Fix released in htop 3.0.0

Changed in htop (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.