Memory bug in TMenuView Constructor

1654843

May 12 1997 2:37PM


There is a bug in MacApp Release 12, TMenuView::IMenuView, apparently introduced when the method was revised to prevent the same menu from being placed into the menu array twice. The bug is caused by an invalidated reference to a relocatable block. It does not cause a crash but may prevent pMenuArraySize from being correctly constructed, depending on memory conditions at the time of this call.

The code reads:

		MenuArrayPtr p = *pMenuArray;
		Boolean foundSlot = FALSE;
		for (ResNumber i = 0; i < pMenuArraySize; ++i) {
			if (p[i].mID == kNoResource) {
				p[i].mID = (*m)->menuID;
				p[i].mObject = this;
				foundSlot = TRUE;
			}
		}
		if (!foundSlot) {
			SetPermHandleSize((Handle) pMenuArray, sizeof(MenuRec)
                        * (pMenuArraySize + 1));
			++pMenuArraySize;

			p[pMenuArraySize-1].mID = (*m)->menuID;
			p[pMenuArraySize-1].mObject = this;
		}
Note that p refers to a relocatable block and can be made invalid by SetPermHandleSize. The following is a possible fix (that I have tested and confirmed):
		MenuArrayPtr p = *pMenuArray;
		Boolean foundSlot = FALSE;
		for (ResNumber i = 0; i < pMenuArraySize; ++i) {
			if (p[i].mID == kNoResource) {
				p[i].mID = (*m)->menuID;
				p[i].mObject = this;
				foundSlot = TRUE;
			}
		}
		if (!foundSlot) {
			SetPermHandleSize((Handle) pMenuArray, sizeof(MenuRec)
			   * (pMenuArraySize + 1));
			++pMenuArraySize;
			p = *pMenuArray;
			p[pMenuArraySize-1].mID = (*m)->menuID;
			p[pMenuArraySize-1].mObject = this;
		}

In this case, p is reassigned after SetPermHandleSize is called.
Fix:

No specific fix mentioned but bug was verified as fixed.