Bug 51720

Here is another backtrace from libraries with debug info 
 
[New Thread 1024 (LWP 635)] 
0x41041609 in wait4 () from /lib/libc.so.6 
#0  0x41041609 in wait4 () from /lib/libc.so.6 
#1  0x410b6dd0 in __check_rhosts_file () from /lib/libc.so.6 
#2  0x40eaeeeb in waitpid () from /lib/libpthread.so.0 
#3  0x4069113c in KCrash::defaultCrashHandler(int) (sig=6) 
    at /home/kde/src/kde/kdelibs/kdecore/kcrash.cpp:235 
#4  0x40eaca44 in pthread_sighandler () from /lib/libpthread.so.0 
#5  0x40fca518 in sigaction () from /lib/libc.so.6 
#6  0x40eace29 in raise () from /lib/libpthread.so.0 
#7  0x40fcb8d1 in abort () from /lib/libc.so.6 
#8  0x40fc4db2 in __assert_fail () from /lib/libc.so.6 
#9  0x4020567a in KRun::slotStatResult(KIO::Job*) () 
    at /home/kde/src/kde/kdelibs/kdecore/kdebug.h:178 
#10 0x4004bbd7 in KParts::BrowserRun::slotStatResult(KIO::Job*) ( 
    this=0x8245c48, job=0x82464d0) 
    at /home/kde/src/kde/kdelibs/kparts/browserrun.cpp:303 
#11 0x4004bf93 in KParts::BrowserRun::qt_invoke(int, QUObject*) ( 
    this=0x8245c48, _id=9, _o=0xbfffe840) 
    at /home/kde/binary/qt-3.1/include/private/qucom_p.h:312 
#12 0x412ee3fd in KonqRun::qt_invoke(int, QUObject*) (this=0x8245c48,  
    _id=-1073747904, _o=0x8245c48) at konq_run.moc:89 
#13 0x409e8376 in QObject::activate_signal(QConnectionList*, 
QUObject*) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#14 0x4016b362 in KIO::Job::result(KIO::Job*) (this=0x82464d0, 
t0=0xfffffe00) 
    at jobclasses.moc:157 
#15 0x40153a2a in KIO::Job::emitResult() (this=0x82464d0) 
    at /home/kde/src/kde/kdelibs/kio/kio/job.cpp:183 
#16 0x4015573e in KIO::SimpleJob::slotFinished() (this=0x82464d0) 
    at /home/kde/src/kde/kdelibs/kio/kio/job.cpp:501 
#17 0x40157392 in KIO::StatJob::slotFinished() (this=0x82464d0) 
    at /home/kde/src/kde/kdelibs/kio/kio/job.cpp:678 
#18 0x4016c3b8 in KIO::StatJob::qt_invoke(int, QUObject*) 
(this=0x82464d0,  
    _id=18, _o=0xbfffeb20) at jobclasses.moc:555 
#19 0x409e8376 in QObject::activate_signal(QConnectionList*, 
QUObject*) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#20 0x409e8233 in QObject::activate_signal(int) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#21 0x4014694e in KIO::SlaveInterface::finished() (this=0xfffffe00) 
    at /home/kde/binary/qt-3.1/include/qmetaobject.h:261 
#22 0x40143e17 in KIO::SlaveInterface::dispatch(int, QMemArray<char> 
const&) ( 
    this=0x8246038, _cmd=104, rawdata=@0x8246038) 
    at /home/kde/src/kde/kdelibs/kio/kio/slaveinterface.cpp:256 
#23 0x40143110 in KIO::SlaveInterface::dispatch() (this=0x8246038) 
    at /home/kde/src/kde/kdelibs/kio/kio/slaveinterface.cpp:192 
#24 0x4013ff18 in KIO::Slave::gotInput() (this=0x40052dd8) 
    at /home/kde/src/kde/kdelibs/kio/kio/slave.cpp:221 
#25 0x401425d0 in KIO::Slave::qt_invoke(int, QUObject*) 
(this=0x8246038,  
    _id=4, _o=0xbfffef20) at slave.moc:114 
#26 0x409e8376 in QObject::activate_signal(QConnectionList*, 
QUObject*) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#27 0x409e8427 in QObject::activate_signal(int, int) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#28 0x40c71cad in QSocketNotifier::activated(int) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#29 0x40a006a0 in QSocketNotifier::event(QEvent*) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#30 0x409942a5 in QApplication::internalNotify(QObject*, QEvent*) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#31 0x40993b40 in QApplication::notify(QObject*, QEvent*) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#32 0x406032f9 in KApplication::notify(QObject*, QEvent*) (this=0x0,  
    receiver=0x8245e00, event=0xbffff1d0) 
    at /home/kde/src/kde/kdelibs/kdecore/kapplication.cpp:453 
#33 0x4097310c in QEventLoop::activateSocketNotifiers() () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#34 0x40954981 in QEventLoop::processEvents(unsigned) () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#35 0x409a5883 in QEventLoop::enterLoop() () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#36 0x409a5740 in QEventLoop::exec() () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#37 0x409944b8 in QApplication::exec() () 
   from /home/kde/binary/qt-3.1/lib/libqt-mt.so.3 
#38 0x412b7aa7 in main (argc=0, argv=0x0) 
    at /home/kde/src/kde/kdebase/konqueror/konq_main.cc:130 
#39 0x0804cbd6 in launch (argc=2, _name=0x805d67c "konqueror",  
    args=0x805d68f "\001", cwd=0x0, envc=1, envs=0x805d686 "--silent",  
    reset_env=false, tty=0x0, avoid_loops=false, startup_id_str=0x0) 
    at /home/kde/src/kde/kdelibs/kinit/kinit.cpp:547 

Subject: I think i've foud the solution

Hi,

I think it is not a kde bug. It appears that
QString & QString::operator+= ( const QByteArray & str ) is broken.
The operator appends more than QByteArray::size() bytes (it appends chars till 
'\0' is not found like null terminated strings).

I've made a small patch for http/webdav io slave (see attached file).



Created an attachment (id=627)
51720.patch

I had the same problem here (KDE3.1 compiled source).  
Used the patch, works now perfectly.  
Isn't it strange this patch did not make it befor the final 3.1 release?  
(not sure that's the right place to put a comment, and am not sure someone will see  
that to integrate it in the 3.1.1 release)  
 
When is a bug closed? 
  
Thanks for the webdav client anyway (and thanks for the patch)  
Life is so easier with the tools you are developping!  

Subject: KDE_3_1_BRANCH: kdelibs/kioslave/http

CVS commit by staikos: 

Apply Eugene's patch

CCMAIL: 51720-done@bugs.kde.org


  M +6 -0      http.cc   1.551.2.7


--- kdelibs/kioslave/http/http.cc  #1.551.2.6:1.551.2.7
@@ -3813,4 +3813,10 @@ void HTTPProtocol::slotData(const QByteA
    else
    {
+      // bugfix from Eugene Onischenko - #51720 - Make sure that the buffer
+      // is null terminated when we append to a string since Qt doesn't look
+      // at m_bufReceive.size() in QString::operator+=(const QByteArray&)
+                // I'm not sure if this is always very efficient unfortunately.
+      m_bufReceive.resize(m_bufReceive.size()+1);
+      m_bufReceive.data()[m_bufReceive.size()-1] = 0;
       m_intData += m_bufReceive;
    }