| Summary: | kate .gnupg/secring.gpg crashes kate | ||
|---|---|---|---|
| Product: | [Frameworks and Libraries] frameworks-kcodecs | Reporter: | micu <micuintus> |
| Component: | general | Assignee: | kdelibs bugs <kdelibs-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | CC: | davide, egorov, kdespam34fb987, rlaggren, simonandric5 |
| Priority: | NOR | Keywords: | drkonqi |
| Version: | 5.19.0 | ||
| Target Milestone: | --- | ||
| Platform: | Fedora RPMs | ||
| OS: | Linux | ||
| Latest Commit: | http://commits.kde.org/kcodecs/d9a99dce9d63cab0429ac94acb160304e2bfa36f | Version Fixed In: | |
| Sentry Crash Report: | |||
| Attachments: | gdb backtrace with additional info | ||
|
Description
micu
2015-12-30 14:37:58 UTC
I can reproduce it. It looks like the problem is in kcodecs.
UnicodeGroupProber::HandleData has this code:
if (4 >= aBuf[1] && aBuf[1] >= 0 && isprint(aBuf[0])) {
where isprint is a macro:
enum {
// non-relevant
CTYPE_PRINT = 1 << 6,
// non-relevant
};
#define ctype_test(c, t) ((ctype_data[(unsigned short)c] & t) != 0)
#define isprint(c) ctype_test((c), CTYPE_PRINT)
And sometimes aBuf contains negative values. So we got an out-of-bounds index for ctype_data array: c is negative in "(unsigned short)c".
I don't know what to do with this, but I think it is a kcodecs bug.
Created attachment 96479 [details]
gdb backtrace with additional info
Trace from current sources, tested with file from bug #360797: #0 0x00007ffff48d1e66 in kencodingprober::UnicodeGroupProber::HandleData(char const*, unsigned int) (this=0x7cc6b0, aBuf=0xd38f90 "\341\001\201P\212u\236\273@\242\346\203\001\254U\203\002\310*\203\003\254F\210\004\210\005\230\004\234\006\201\a\202a\274\362\266J\300\326o\326\210\b\377\023\210\t\377\023\203\025\214\356V\211\021\234\022\210", <incomplete sequence \303>, aLen=63) at frameworks/kcodecs/src/probers/UnicodeGroupProber.cpp:89 #1 0x00007ffff48d4046 in kencodingprober::nsMBCSGroupProber::HandleData(char const*, unsigned int) (this=0xa777a0, aBuf=0xda3098 "\341\001", aLen=120) at frameworks/kcodecs/src/probers/nsMBCSGroupProber.cpp:119 #2 0x00007ffff48d56eb in kencodingprober::nsUniversalDetector::HandleData(char const*, unsigned int) (this=0xd42600, aBuf=0xda3098 "\341\001", aLen=120) at frameworks/kcodecs/src/probers/nsUniversalDetector.cpp:149 #3 0x00007ffff48c9c22 in KEncodingProber::feed(char const*, int) (this=0x7fffffffc010, data=0xda3098 "\341\001", len=120) at frameworks/kcodecs/src/kencodingprober.cpp:181 #4 0x00007ffff76cdee8 in Kate::TextLoader::readLine(int&, int&) (this=0x7fffffffc120, offset=@0x7fffffffc18c: 0, length=@0x7fffffffc188: 0) at frameworks/ktexteditor/src/buffer/katetextloader.h:266 #5 0x00007ffff76cb2f0 in Kate::TextBuffer::load(QString const&, bool&, bool&, int&, bool) (this= 0x7df1e0, filename=..., encodingErrors=@0x7df2a8: false, tooLongLinesWrapped=@0x7df2a9: false, longestLineLoaded=@0x7df2ac: 0, enforceTextCodec=false) at frameworks/ktexteditor/src/buffer/katetextbuffer.cpp:621 #6 0x00007ffff777aef3 in KateBuffer::openFile(QString const&, bool) (this=0x7df1e0, m_file=..., enforceTextCodec=false) at frameworks/ktexteditor/src/document/katebuffer.cpp:195 #7 0x00007ffff775133e in KTextEditor::DocumentPrivate::openFile() (this=0x7d4cc0) at frameworks/ktexteditor/src/document/katedocument.cpp:2252 #8 0x00007ffff6f57035 in KParts::ReadOnlyPartPrivate::openLocalFile() (this=0x7cc280) at frameworks/kparts/src/readonlypart.cpp:187 #9 0x00007ffff6f56cc2 in KParts::ReadOnlyPart::openUrl(QUrl const&) (this=0x7d4cc0, url=...) at frameworks/kparts/src/readonlypart.cpp:150 #10 0x00007ffff7753c44 in KTextEditor::DocumentPrivate::openUrl(QUrl const&) (this=0x7d4cc0, url=...) at frameworks/ktexteditor/src/document/katedocument.cpp:2596 #11 0x000000000041bbf1 in KWrite::loadURL(QUrl const&) (this=0x7398b0, url=...) at kde/applications/kate/kwrite/kwrite.cpp:202 #12 0x00000000004176e0 in main(int, char**) (argc=2, argv=0x7fffffffd9a8) at kde/app And here the valgrind trace for the same file: ==26843== Conditional jump or move depends on uninitialised value(s) ==26843== at 0x8137D93: kencodingprober::UnicodeGroupProber::HandleData(char const*, unsigned int) (UnicodeGroupProber.cpp:84) ==26843== by 0x813A045: kencodingprober::nsMBCSGroupProber::HandleData(char const*, unsigned int) (nsMBCSGroupProber.cpp:119) ==26843== by 0x813B6EA: kencodingprober::nsUniversalDetector::HandleData(char const*, unsigned int) (nsUniversalDetector.cpp:149) ==26843== by 0x812FC21: KEncodingProber::feed(char const*, int) (kencodingprober.cpp:181) ==26843== by 0x4EF8EE7: Kate::TextLoader::readLine(int&, int&) (katetextloader.h:266) ==26843== by 0x4EF62EF: Kate::TextBuffer::load(QString const&, bool&, bool&, int&, bool) (katetextbuffer.cpp:621) ==26843== by 0x4FA5EF2: KateBuffer::openFile(QString const&, bool) (katebuffer.cpp:195) ==26843== by 0x4F7C33D: KTextEditor::DocumentPrivate::openFile() (katedocument.cpp:2252) ==26843== by 0x5A9A034: KParts::ReadOnlyPartPrivate::openLocalFile() (readonlypart.cpp:187) ==26843== by 0x5A99CC1: KParts::ReadOnlyPart::openUrl(QUrl const&) (readonlypart.cpp:150) ==26843== by 0x4F7EC43: KTextEditor::DocumentPrivate::openUrl(QUrl const&) (katedocument.cpp:2596) ==26843== by 0x41BBF0: KWrite::loadURL(QUrl const&) (kwrite.cpp:202) ==26843== ==26843== Conditional jump or move depends on uninitialised value(s) ==26843== at 0x8137E1F: kencodingprober::UnicodeGroupProber::HandleData(char const*, unsigned int) (UnicodeGroupProber.cpp:85) ==26843== by 0x813A045: kencodingprober::nsMBCSGroupProber::HandleData(char const*, unsigned int) (nsMBCSGroupProber.cpp:119) ==26843== by 0x813B6EA: kencodingprober::nsUniversalDetector::HandleData(char const*, unsigned int) (nsUniversalDetector.cpp:149) ==26843== by 0x812FC21: KEncodingProber::feed(char const*, int) (kencodingprober.cpp:181) ==26843== by 0x4EF8EE7: Kate::TextLoader::readLine(int&, int&) (katetextloader.h:266) ==26843== by 0x4EF62EF: Kate::TextBuffer::load(QString const&, bool&, bool&, int&, bool) (katetextbuffer.cpp:621) ==26843== by 0x4FA5EF2: KateBuffer::openFile(QString const&, bool) (katebuffer.cpp:195) ==26843== by 0x4F7C33D: KTextEditor::DocumentPrivate::openFile() (katedocument.cpp:2252) ==26843== by 0x5A9A034: KParts::ReadOnlyPartPrivate::openLocalFile() (readonlypart.cpp:187) ==26843== by 0x5A99CC1: KParts::ReadOnlyPart::openUrl(QUrl const&) (readonlypart.cpp:150) ==26843== by 0x4F7EC43: KTextEditor::DocumentPrivate::openUrl(QUrl const&) (katedocument.cpp:2596) ==26843== by 0x41BBF0: KWrite::loadURL(QUrl const&) (kwrite.cpp:202) ==26843== ==26843== ==26843== Process terminating with default action of signal 11 (SIGSEGV) ==26843== Bad permissions for mapped region at address 0x8170F22 ==26843== at 0x8137E66: kencodingprober::UnicodeGroupProber::HandleData(char const*, unsigned int) (UnicodeGroupProber.cpp:89) ==26843== by 0x813A045: kencodingprober::nsMBCSGroupProber::HandleData(char const*, unsigned int) (nsMBCSGroupProber.cpp:119) ==26843== by 0x813B6EA: kencodingprober::nsUniversalDetector::HandleData(char const*, unsigned int) (nsUniversalDetector.cpp:149) ==26843== by 0x812FC21: KEncodingProber::feed(char const*, int) (kencodingprober.cpp:181) ==26843== by 0x4EF8EE7: Kate::TextLoader::readLine(int&, int&) (katetextloader.h:266) ==26843== by 0x4EF62EF: Kate::TextBuffer::load(QString const&, bool&, bool&, int&, bool) (katetextbuffer.cpp:621) ==26843== by 0x4FA5EF2: KateBuffer::openFile(QString const&, bool) (katebuffer.cpp:195) ==26843== by 0x4F7C33D: KTextEditor::DocumentPrivate::openFile() (katedocument.cpp:2252) ==26843== by 0x5A9A034: KParts::ReadOnlyPartPrivate::openLocalFile() (readonlypart.cpp:187) ==26843== by 0x5A99CC1: KParts::ReadOnlyPart::openUrl(QUrl const&) (readonlypart.cpp:150) ==26843== by 0x4F7EC43: KTextEditor::DocumentPrivate::openUrl(QUrl const&) (katedocument.cpp:2596) ==26843== by 0x41BBF0: KWrite::loadURL(QUrl const&) (kwrite.cpp:202) *** Bug 360797 has been marked as a duplicate of this bug. *** Git commit d9a99dce9d63cab0429ac94acb160304e2bfa36f by Dominik Haumann. Committed on 29/03/2016 at 15:52. Pushed by dhaumann into branch 'master'. encoding detection: fix crash in wrong usage of isprint If the first characters was negative, we always hit a crash in the encoding detection. This patch fixes this. REVIEW: 127488 CHANGELOG: encoding detection: fix crash in wrong usage of isprint (bug #357341) A +- -- autotests/data/binary_data M +11 -0 autotests/kencodingprobertest.cpp M +3 -1 src/probers/UnicodeGroupProber.cpp http://commits.kde.org/kcodecs/d9a99dce9d63cab0429ac94acb160304e2bfa36f *** Bug 343261 has been marked as a duplicate of this bug. *** *** Bug 362273 has been marked as a duplicate of this bug. *** |