widgets/wt_label.c: Skip fillup on negative w->w

[lanodan]

If w->w is negative malloc can fail and return NULL, which results in a segfault.

Also changed it to use calloc instead of malloc to avoid potential overflows.

[Minoru]

Hi! It's quite surprising to see Pleroma maintainer fixing bugs in a C library I thought nobody else uses :)

I don't think calloc makes a difference here because the return value is never checked; it could still segfault if widget's width is wide enough. Apart from that, the change makes sense to me and I'm inclined to merge it, but I got two questions:

1. did you actually trigger the crash? I wonder how w->w can become negative, and I couldn't quickly find it in the code. (But I'm not familiar with STFL's internals, to be honest.)
2. I see the same malloc invocation in wt_checkbox.c and wt_list.c. Can you please apply the fix there as well?

[lanodan]

Hi! It's quite surprising to see Pleroma maintainer fixing bugs in a C library I thought nobody else uses :)

Heh well I've been using newsboat for many years, like according to package logs on my desktop at least 2018 but could be even earlier.

I don't think calloc makes a difference here because the return value is never checked; it could still segfault if widget's width is wide enough. Apart from that, the change makes sense to me and I'm inclined to merge it, but I got two questions:

Right, could add an assert but given that without it you get null dereference it would crash anyway, meanwhile malloc with an overflow would mean wrong size being allocated which is much harder to diagnose.

1. did you actually trigger the crash? I wonder how w->w can become negative, and I couldn't quickly find it in the code. (But I'm not familiar with STFL's internals, to be honest.)

Yeah, newsboat (2.13, I have rust masked out but well that's on me) was crashing on me when the terminal would get resized.

Here's backtrace and variables at time of crash: lldb-newsboat.log

2. I see the same malloc invocation in wt_checkbox.c and wt_list.c. Can you please apply the fix there as well?

Yeah, makes sense.

[Minoru]

Got it; thanks!