[slinuxgeek]

I think I have found a bug in xbmc-12.0 Frodo source, details are as follows:

In file "xbmc-12.0/xbmc/dbwrappers/dataset.cpp"
In function "DbErrors:bErrors(const char *msg, ...)"
if msg contains "%s" or "%n" then, xbmc terminates with Segmentation fault.

It can contain such strings as it contains query that failed and in query we can have "like %s%" etc.

It seems the %s and %n are being treated as format specifires and tries to fetch some memory location.

Thanks

[Memphiz]

Howto reproduce that?

[slinuxgeek]

In "xbmc-12.0/xbmc/music/MusicDatabase.cpp"
In function "bool CMusicDatabase::Search(const CStdString& search, CFileItemList &items)"
I had following query which was working with xbmc-11.0 but failed for xbmc-12.0 because strArtist has been renamed to strArtists in new database file ".xbmc/userdata/Database/MyMusic32.db"

strSQL = PrepareSQL("select * from albumview where idAlbum in (select idAlbum from songview where strTitle like '%%%s%%' or strAlbum like '%%%s%%' or strArtist like '%%%s%%' limit 1000)", search.c_str(), search.c_str(), search.c_str());

obviously it should fail but xbmc should not crash, also it crashes only if I type 's' or 'n' in search box

[spiff]

ahaha. nice one..