GNU bug report logs - #14345
24.3; shr-insert-document crashes gtk-emacs

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#14345: closed (24.3; shr-insert-document crashes gtk-emacs)
Date: Sun, 12 May 2013 19:22:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Sun, 12 May 2013 12:21:21 -0700
with message-id <518FEBB1.1060905 <at> cs.ucla.edu>
and subject line Re: 24.3; shr-insert-document crashes gtk-emacs
has caused the debbugs.gnu.org bug report #14345,
regarding 24.3; shr-insert-document crashes gtk-emacs
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
14345: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=14345
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: David Bremner <david <at> tethera.net>
To: bug-gnu-emacs <at> gnu.org
Subject: 24.3; shr-insert-document crashes gtk-emacs
Date: Fri, 03 May 2013 23:43:09 -0300

[Message part 3 (text/plain, inline)]

0) save the attached file as crash.el
1) emacs -Q crash.el
2) M-x eval-buffer

Or, if you prefer, evaluate the first two lines sequentially.

The document is inserted (as far as I can tell) correctly if I run 
emacs -nw

[crash.el (application/emacs-lisp, attachment)]

[Message part 5 (text/plain, inline)]

unfortunately I don't have debugging symbols for emacs. But it seems
easy to reproduce, and was originally reported on gentoo, before I
duplicated it on Debian.

In GNU Emacs 24.3.1 (x86_64-pc-linux-gnu, GTK+ Version 3.4.2)
 of 2013-04-13 on trouble, modified by Debian
Windowing system distributor `The X.Org Foundation', version 11.0.11204000
System Description:	Debian GNU/Linux 7.0 (wheezy)

Configured using:
 `configure '--build' 'x86_64-linux-gnu' '--build' 'x86_64-linux-gnu'
 '--prefix=/usr' '--sharedstatedir=/var/lib' '--libexecdir=/usr/lib'
 '--localstatedir=/var/lib' '--infodir=/usr/share/info'
 '--mandir=/usr/share/man' '--with-pop=yes'
 '--enable-locallisppath=/etc/emacs24:/etc/emacs:/usr/local/share/emacs/24.3/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/24.3/site-lisp:/usr/share/emacs/site-lisp'
 '--with-crt-dir=/usr/lib/x86_64-linux-gnu' '--with-x=yes'
 '--with-x-toolkit=gtk3' '--with-toolkit-scroll-bars'
 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fstack-protector
 --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wall'
 'LDFLAGS=-Wl,-z,relro' 'CPPFLAGS=-D_FORTIFY_SOURCE=2''

Important settings:
  value of $LANG: en_CA.UTF-8
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x r e p o r SPC <tab> <return>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr emacsbug message format-spec rfc822 mml
easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils time-date tooltip ediff-hook vc-hooks
lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image regexp-opt
fringe tabulated-list newcomment lisp-mode register page menu-bar
rfn-eshadow timer select scroll-bar mouse jit-lock font-lock syntax
facemenu font-core frame cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese hebrew greek romanian slovak
czech european ethiopic indian cyrillic chinese case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer loaddefs button faces
cus-face macroexp files text-properties overlay sha1 md5 base64 format
env code-pages mule custom widget hashtable-print-readable backquote
make-network-process dbusbind dynamic-setting system-font-setting
font-render-setting move-toolbar gtk x-toolkit x multi-tty emacs)

[Message part 6 (message/rfc822, inline)]

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: 14345-done <at> debbugs.gnu.org
Subject: Re: 24.3; shr-insert-document crashes gtk-emacs
Date: Sun, 12 May 2013 12:21:21 -0700

I installed the following patch as trunk bzr 112562 to fix
this.  It works for me, including for Glenn's C-c C-c test.
I'll cross my fingers and mark the bug as fixed.

=== modified file 'src/ChangeLog'
--- src/ChangeLog	2013-05-09 18:30:46 +0000
+++ src/ChangeLog	2013-05-12 19:14:22 +0000
@@ -1,3 +1,7 @@
+2013-05-12  Paul Eggert  <eggert <at> cs.ucla.edu>
+
+	* image.c (gif_load): Check that subimages fit (Bug#14345).
+
 2013-05-09  Stefan Monnier  <monnier <at> iro.umontreal.ca>
 
 	* lread.c (skip_dyn_eof): New function.

=== modified file 'src/image.c'
--- src/image.c	2013-04-07 04:41:19 +0000
+++ src/image.c	2013-05-12 19:15:38 +0000
@@ -7263,6 +7263,25 @@
       return 0;
     }
 
+  /* Check that the selected subimages fit.  It's not clear whether
+     the GIF spec requires this, but Emacs can crash if they don't fit.  */
+  for (j = 0; j <= idx; ++j)
+    {
+      struct SavedImage *subimage = gif->SavedImages + j;
+      int subimg_width = subimage->ImageDesc.Width;
+      int subimg_height = subimage->ImageDesc.Height;
+      int subimg_top = subimage->ImageDesc.Top;
+      int subimg_left = subimage->ImageDesc.Left;
+      if (! (0 <= subimg_width && 0 <= subimg_height
+	     && 0 <= subimg_top && subimg_top <= height - subimg_height
+	     && 0 <= subimg_left && subimg_left <= width - subimg_width))
+	{
+	  image_error ("Subimage does not fit in image", Qnil, Qnil);
+	  fn_DGifCloseFile (gif);
+	  return 0;
+	}
+    }
+
   /* Create the X image and pixmap.  */
   if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap))
     {

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.