Fix bug #16644: Output Driver crashes in DISPLAY VARIABLES.

diff --git a/src/output/ChangeLog b/src/output/ChangeLog
index 2b88fec4d2564645546ee62b50d3e30055d562eb..7c1d3d1c654695bd1b2aaa90e8fd9acba7fb39d5 100644 (file)
--- a/src/output/ChangeLog
+++ b/src/output/ChangeLog
@@ -1,3 +1,11 @@
+Sat Jul  1 22:41:26 2006  Ben Pfaff  <blp@gnu.org>
+
+       Fix bug #16644: Output Driver crashes in DISPLAY VARIABLES.
+       
+       * table.c (tab_create): Don't allocate t->hrh, t->wrv yet, because
+       the table size might change before we're ready to use them.
+       (tabi_table) Allocate them here instead.
+
 Fri Jun  9 14:42:35 2006  Ben Pfaff  <blp@gnu.org>
 
        Reform string library.

diff --git a/src/output/table.c b/src/output/table.c
index cb06a3f1f910db84b1d4267652ddffdc62aa6a5c..1b120124a4ce8022893d153e2b0d91117070ee41 100644 (file)
--- a/src/output/table.c
+++ b/src/output/table.c
@@ -71,15 +71,9 @@ tab_create (int nc, int nr, int reallocable UNUSED)
   t->rh = pool_nmalloc (t->container, nc, nr + 1);
   memset (t->rh, 0, nc * (nr + 1));
 
-  t->hrh = pool_nmalloc (t->container, nr + 1, sizeof *t->hrh);
-  memset (t->hrh, 0, sizeof *t->hrh * (nr + 1));
-
   t->rv = pool_nmalloc (t->container, nr, nc + 1);
   memset (t->rv, UCHAR_MAX, nr * (nc + 1));
 
-  t->wrv = pool_nmalloc (t->container, nc + 1, sizeof *t->wrv);
-  memset (t->wrv, 0, sizeof *t->wrv * (nc + 1));
-
   t->dim = NULL;
   t->w = t->h = NULL;
   t->col_ofs = t->row_ofs = 0;
@@ -857,6 +851,8 @@ tabi_table (struct som_entity *table)
   assert (t->w == NULL && t->h == NULL);
   t->w = pool_nalloc (t->container, t->nc, sizeof *t->w);
   t->h = pool_nalloc (t->container, t->nr, sizeof *t->h);
+  t->hrh = pool_nmalloc (t->container, t->nr + 1, sizeof *t->hrh);
+  t->wrv = pool_nmalloc (t->container, t->nc + 1, sizeof *t->wrv);
 }
 
 /* Returns the line style to use for spacing purposes for a rule