Bug 372530

Summary: Konsole crashes when downloading image with curl
Product: [Applications] konsole Reporter: Łukasz Żarnowiecki <lukasz>
Component: generalAssignee: Konsole Developer <konsole-devel>
Status: RESOLVED FIXED    
Severity: crash CC: martin.sandsmark
Priority: NOR Keywords: drkonqi
Version: 16.08.3   
Target Milestone: ---   
Platform: Arch Linux   
OS: Linux   
Latest Commit: https://commits.kde.org/konsole/76453a7df8427048a8ce92169c3dbd172f89798c Version Fixed In:
Sentry Crash Report:

Description Łukasz Żarnowiecki 2016-11-16 11:34:31 UTC 
Application: konsole (16.08.3)

Qt Version: 5.7.0
Frameworks Version: 5.27.0
Operating System: Linux 4.8.7-1-ARCH x86_64
Distribution (Platform): Archlinux Packages

-- Information about the crash:
- What I was doing when the application crashed:

Just execute curl with this argument:

curl http://images-cdn.azureedge.net/azure/lulu-resources/fc211e9f-cffc-4ad2-88fb-99bc9faf96e1/Images/ProductImages/Source/1023019-01.jpg -L

The crash can be reproduced every time.

-- Backtrace:
Application: Konsola (konsole), signal: Aborted
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[Current thread is 1 (Thread 0x7fd2ceda27c0 (LWP 13071))]

Thread 3 (Thread 0x7fd2b374e700 (LWP 13073)):
#0  0x00007fd2ce76048d in poll () from /usr/lib/libc.so.6
#1  0x00007fd2c4a9f786 in ?? () from /usr/lib/libglib-2.0.so.0
#2  0x00007fd2c4a9f89c in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#3  0x00007fd2cacf1ddb in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#4  0x00007fd2cac9a35a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#5  0x00007fd2caab68c3 in QThread::exec() () from /usr/lib/libQt5Core.so.5
#6  0x00007fd2c8dffe55 in ?? () from /usr/lib/libQt5DBus.so.5
#7  0x00007fd2caabb5e8 in ?? () from /usr/lib/libQt5Core.so.5
#8  0x00007fd2c6534454 in start_thread () from /usr/lib/libpthread.so.0
#9  0x00007fd2ce7697df in clone () from /usr/lib/libc.so.6

Thread 2 (Thread 0x7fd2b9b3d700 (LWP 13072)):
#0  0x00007fd2ce76048d in poll () from /usr/lib/libc.so.6
#1  0x00007fd2c69598e0 in ?? () from /usr/lib/libxcb.so.1
#2  0x00007fd2c695b679 in xcb_wait_for_event () from /usr/lib/libxcb.so.1
#3  0x00007fd2bbe907d9 in ?? () from /usr/lib/libQt5XcbQpa.so.5
#4  0x00007fd2caabb5e8 in ?? () from /usr/lib/libQt5Core.so.5
#5  0x00007fd2c6534454 in start_thread () from /usr/lib/libpthread.so.0
#6  0x00007fd2ce7697df in clone () from /usr/lib/libc.so.6

Thread 1 (Thread 0x7fd2ceda27c0 (LWP 13071)):
[KCrash Handler]
#6  0x00007fd2ce6b404f in raise () from /usr/lib/libc.so.6
#7  0x00007fd2ce6b547a in abort () from /usr/lib/libc.so.6
#8  0x00007fd2caaa1739 in QMessageLogger::fatal(char const*, ...) const () from /usr/lib/libQt5Core.so.5
#9  0x00007fd2caa9cb81 in qt_assert_x(char const*, char const*, char const*, int) () from /usr/lib/libQt5Core.so.5
#10 0x00007fd2ce3dc160 in QVector<Konsole::Character>::operator[] (i=<optimized out>, this=<optimized out>) at /usr/include/qt/QtCore/qvector.h:433
#11 Konsole::Screen::displayCharacter (this=0x2116fe0, c=<optimized out>) at /home/dlh/abs/konsole/src/konsole-16.08.3/src/Screen.cpp:660
#12 0x00007fd2ce4259de in Konsole::Vt102Emulation::processToken (this=this@entry=0x211f5e0, token=<optimized out>, p=1866, q=<optimized out>) at /home/dlh/abs/konsole/src/konsole-16.08.3/src/Vt102Emulation.cpp:459
#13 0x00007fd2ce428390 in Konsole::Vt102Emulation::receiveChar (this=0x211f5e0, cc=1866) at /home/dlh/abs/konsole/src/konsole-16.08.3/src/Vt102Emulation.cpp:388
#14 0x00007fd2ce3a6cc1 in Konsole::Emulation::receiveData (this=0x211f5e0, text=0x1a96408 "\n\313|\313m\365\037'\351\226s\212\\\270V\364\273\201\217Ub+R\244\327\240\243W\266\002\202\236\371\036\065\237\315\266\321\070\250\342\324\355\373\071)\r\231\004\277X\004j\367k\320\006j}\004\344a\311QV>[\270\276\321\245\325\205\302\307\350\232\b\230\200O\321\211;\323\025o$\333\375w\314\221\363\247(\343\345\364\214\234\271/T\027\230\231\333\\\274\062\036T%A\356(r1\344\316\\\222\347+\304\251\335\251\261=\361\210\335\256<\331`\210\334\376^3Jk\350\021\351\037\f\177\211\262\\\227I\021\266\374\275\215\321\250.\034\031=\311\310\236h\350\304B\237EO\373\255\067\003\337&\305\063\362\343\311\376\"\265!\250I\241\367\031\036\214"..., length=4095) at /home/dlh/abs/konsole/src/konsole-16.08.3/src/Emulation.cpp:225
#15 0x00007fd2cacc8bcc in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib/libQt5Core.so.5
#16 0x00007fd2ce42b08d in Konsole::Pty::receivedData (this=this@entry=0x2120220, _t1=<optimized out>, _t2=<optimized out>) at /home/dlh/abs/konsole/src/build/src/moc_Pty.cpp:148
#17 0x00007fd2ce3d55a8 in Konsole::Pty::dataReceived (this=0x2120220) at /home/dlh/abs/konsole/src/konsole-16.08.3/src/Pty.cpp:88
#18 0x00007fd2cacc8bcc in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib/libQt5Core.so.5
#19 0x00007fd2c9fd9a92 in ?? () from /usr/lib/libKF5Pty.so.5
#20 0x00007fd2c9fd9fc9 in ?? () from /usr/lib/libKF5Pty.so.5
#21 0x00007fd2cacc8898 in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib/libQt5Core.so.5
#22 0x00007fd2cad43aae in QSocketNotifier::activated(int, QSocketNotifier::QPrivateSignal) () from /usr/lib/libQt5Core.so.5
#23 0x00007fd2cacd56f2 in QSocketNotifier::event(QEvent*) () from /usr/lib/libQt5Core.so.5
#24 0x00007fd2cbc29dfc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#25 0x00007fd2cbc31559 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#26 0x00007fd2cac9bf30 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#27 0x00007fd2cacf227d in ?? () from /usr/lib/libQt5Core.so.5
#28 0x00007fd2c4a9f587 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#29 0x00007fd2c4a9f7f0 in ?? () from /usr/lib/libglib-2.0.so.0
#30 0x00007fd2c4a9f89c in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#31 0x00007fd2cacf1dbf in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#32 0x00007fd2cac9a35a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#33 0x00007fd2caca29bc in QCoreApplication::exec() () from /usr/lib/libQt5Core.so.5
#34 0x00007fd2cea482c7 in kdemain (argc=<optimized out>, argv=<optimized out>) at /home/dlh/abs/konsole/src/konsole-16.08.3/src/main.cpp:176
#35 0x00007fd2ce6a1291 in __libc_start_main () from /usr/lib/libc.so.6
#36 0x000000000040065a in _start ()

Reported using DrKonqi
Comment 1 Martin Sandsmark 2016-11-20 12:32:32 UTC 
Can't reproduce it here (same setup). What is the assert it prints out when crashing (i. e. what index is out of range)?
Comment 2 Martin Sandsmark 2016-11-20 13:01:46 UTC 
Figured it out; the cursorRight() call doesn't resize the line buffer, so it fails when trying to get combining characters after a bunch of wild cursorRight() calls. I'll create some patches.
Comment 3 Martin Sandsmark 2016-11-20 13:12:01 UTC 
Git commit 80b9e0775ecc81a4462e932be7ffdb1e5b222a4d by Martin T. H. Sandsmark.
Committed on 20/11/2016 at 13:04.
Pushed by sandsmark into branch 'master'.

Fix crash with combining characters after several cursorRight() calls

cursorRight() does not resize the _screenLines vector, leading to an
assert in QVector when trying to look up the _cuX which is bigger than
the amount of characters in the current line.

M  +1    -1    src/Screen.cpp

http://commits.kde.org/konsole/80b9e0775ecc81a4462e932be7ffdb1e5b222a4d
Comment 4 Kurt Hindenburg 2016-11-24 14:47:46 UTC 
Git commit 76453a7df8427048a8ce92169c3dbd172f89798c by Kurt Hindenburg, on behalf of Martin T. H. Sandsmark.
Committed on 24/11/2016 at 14:42.
Pushed by hindenburg into branch 'Applications/16.12'.

Fix crash with combining characters after several cursorRight() calls

cursorRight() does not resize the _screenLines vector, leading to an
assert in QVector when trying to look up the _cuX which is bigger than
the amount of characters in the current line.
(cherry picked from commit 80b9e0775ecc81a4462e932be7ffdb1e5b222a4d)

M  +1    -1    src/Screen.cpp

https://commits.kde.org/konsole/76453a7df8427048a8ce92169c3dbd172f89798c