[Pan-devel] [PATCH] infinite loop / 100% CPU in phrase filter

[Johannes Stezenbach]

Hi,

I was playing with pan to read some mailing lists on news.gmane.org, and
noticed that the subject/author search function often does not work, and
causes 100% CPU load in some background thread.
(E.g. in group gmane.linux.fbdev.devel.)

This tiny patch seems to fix it:

Index: pan/filters/filter-phrase.c
===================================================================
RCS file: /cvs/gnome/pan/pan/filters/filter-phrase.c,v
retrieving revision 1.31
diff -u -p -r1.31 filter-phrase.c
--- pan/filters/filter-phrase.c 7 Jan 2004 20:26:20 -0000       1.31
+++ pan/filters/filter-phrase.c 20 May 2004 16:12:20 -0000
@@ -619,7 +619,7 @@ filter_phrase_set (FilterPhrase        *
                        const char * pat = filter->private_key;
                        const int len = filter->private_key_len;
 
-                       for (i=0; i<UCHAR_MAX; ++i)
+                       for (i=0; i<=UCHAR_MAX; ++i)
                                skip[i] = len + 1;
                        for (i=0; i<len; i++)
                                skip[(guchar)(pat[i])] = len - i;
Index: pan/filters/filter-phrase.h
===================================================================
RCS file: /cvs/gnome/pan/pan/filters/filter-phrase.h,v
retrieving revision 1.16
diff -u -p -r1.16 filter-phrase.h
--- pan/filters/filter-phrase.h 27 Nov 2003 08:50:24 -0000      1.16
+++ pan/filters/filter-phrase.h 20 May 2004 16:12:20 -0000
@@ -71,7 +71,7 @@ struct _FilterPhrase
 
        char * private_key;
        int private_key_len;
-       char bmhs_skip[UCHAR_MAX];
+       char bmhs_skip[UCHAR_MAX + 1];
 
        PcreInfo * pcre_info;
        int pcre_state;




In gdb I saw that in bmhs_isearch():
                /* scan loop that searches for the first character of the 
pattern */
                while (t<text_end && *t!=first_uc && *t!=first_lc)
                        t += skip[tolower(t[pat_len])];

tolower(t[pat_len]) returned 255 for some reason, and skip[255] was 0...




Also, in the same function, line 294:
                t += skip[t[pat_len]];

could be a copy&paste error from bmhs_search()? Should it
not read:
                t += skip[tolower(t[pat_len])];

Since I don't know the algorithm well enough, I decided not to
change it in my patch. But I tried it out, and it did not make
a difference for me...


Regards,
Johannes