[kmymoney] [Bug 422561] New: A half-empty PRICEPAIR causes app to crash when attempting to update prices

[Dawid Wróbel]

https://bugs.kde.org/show_bug.cgi?id=422561

            Bug ID: 422561
           Summary: A half-empty PRICEPAIR causes app to crash when
                    attempting to update prices
           Product: kmymoney
           Version: git (master)
          Platform: unspecified
                OS: All
            Status: REPORTED
          Severity: normal
          Priority: NOR
         Component: general
          Assignee: kmymoney-devel at kde.org
          Reporter: me at dawidwrobel.com
  Target Milestone: ---

SUMMARY
My price updating dialog crashes each time I try to update any currency by
hand. It's been like this since I migrated from GnuCash, except I didn't debug
it until now.

I initially pinpointed it to the index out of range exception caused by the
KEquityPriceUpdateDlg::addInvestment() attempting to split the ID by ' '
without double-checking for trailing spaces.

Adding that check, however, doesn't fix the underlying issue and only prevents
the crash from happening. 
Tracing the issue upstream the stack trace I was able to find that:

1) KEquityPriceUpdateDlgPrivate::addPricePair() is not checking whether any of
the first or second price symbols in MyMoneySecurityPair object are empty
2) KEquityPriceUpdateDlgPrivate::init() can be initiated with an empty
securityId (e.g. when but this is very hacky and not clear it is even supported
until the "file->security(pair.first).isCurrency() && (securityId.isEmpty()"
expression
3) That expression only checks whether the first item of the pair is a currency
and so it continues to run even if the second item of the pair is empty. 
4) The actual underlying cause is my .kmm file somehow got the following added:

  <PRICEPAIR from="PLN" to="">
   <PRICE source="Transaction" date="2013-11-12" price="1/1"/>
   <PRICE source="Transaction" date="2014-02-03" price="1/1"/>
   <PRICE source="Transaction" date="2019-06-28" price="1/1"/>
   <PRICE source="Transaction" date="2019-10-04" price="1/1"/>
   <PRICE source="KMyMoney Currency" date="2020-03-20" price="1/1"/>
  </PRICEPAIR>

The first 5 prices were most likely imported as such from GnuCash. The latter,
however, was clearly added by KMyMoney Currency, so this still can be further
traced back to some dodgy behavior somewhere else in the app.
STEPS TO REPRODUCE
1. Add a following PRICEPAIR xml element to your statement file
2. Open the Tools->Update Stock and Currency prices
3. Update any currency, close the dialog

OBSERVED RESULT
The app crashes


EXPECTED RESULT
1) The MyMoneySecurityPair type should not allow empty values or
KEquityPriceUpdateDlgPrivate::addPricePair() should assert() the pair.first and
pair.second are non-empty
2) There shouldn't be any attempt made to add crippled PRICEPAIRs saved at all. 
3) The app shouldn't crash when closing the dialog

-- 
You are receiving this mail because:
You are the assignee for the bug.