[Syncevolution-issues] [Bug 1007] nightly testing + valgrind results
http://bugs.meego.com/show_bug.cgi?id=1007
--- Comment #6 from yongsheng <yongsheng.zhu(a)intel.com> 2010-05-24 22:58:32 PDT ---
For this issue, I find the root cause: read over the size of the
buffer.
In lcs.h line 196:
class accessor {
static C cost(const T &b, ssize_t start, size_t end) {
return b[end].second - (start == -1 ? 0 : b[start].second);
}
}
for(int j = 0; j <=b.size(); j++)
196 C cost_left = sub[i][j-1].cost += access.cost(b, j-1, j);
access.cost(b, j-1, j) will read b[j] and j may equal the size of b, so this
will cause reading an invalid value
The fix is below. The reason is that sub[i][j]
is calculated for a[i-1] and
b[j-1]. Thus the new cost is a[i-1] - a[i-2]. Right?
@@ -150,8 +150,8 @@ void lcs(const T &a, const T &b, ITO out, A access)
Choice choice = MATCH;
size_t length = sub[i-1][j-1].length + 1;
C cost = sub[i-1][j-1].cost;
- C cost_left = sub[i][j-1].cost += access.cost(b, j-1, j);
- C cost_up = sub[i-1][j].cost += access.cost(a, i-1, i);
+ C cost_left = sub[i][j-1].cost += access.cost(b, j-2, j-1);
+ C cost_up = sub[i-1][j].cost += access.cost(a, i-2, i-1);
/*
* We may decide to not match at i,j if the
@@ -186,15 +186,15 @@ void lcs(const T &a, const T &b, ITO out, A access)
} else if (sub[i][j-1].length > sub[i-1][j].length) {
sub[i][j].choice = LEFT;
sub[i][j].length = sub[i][j-1].length;
- sub[i][j].cost = sub[i][j-1].cost + access.cost(b, j-1, j);
+ sub[i][j].cost = sub[i][j-1].cost + access.cost(b, j-2, j-1);
} else if (sub[i][j-1].length < sub[i-1][j].length) {
sub[i][j].choice = UP;
sub[i][j].length = sub[i-1][j].length;
- sub[i][j].cost = sub[i-1][j].cost + access.cost(a, i-1, i);
+ sub[i][j].cost = sub[i-1][j].cost + access.cost(a, i-2, i-1);
} else {
// tie: decide based on cost
- C cost_left = sub[i][j-1].cost += access.cost(b, j-1, j);
- C cost_up = sub[i-1][j].cost += access.cost(a, i-1, i);
+ C cost_left = sub[i][j-1].cost += access.cost(b, j-2, j-1);
+ C cost_up = sub[i-1][j].cost += access.cost(a, i-2, i-1);
if (cost_left < cost_up) {
sub[i][j].choice = LEFT;
--
Configure bugmail: http://bugs.meego.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching someone on the CC list of the bug.