Bug 1255831

Summary: [abrt] Crash under html_text_get_link_at_offset()
Product: Red Hat Enterprise Linux 7 Reporter: Jiri Koten <jkoten>
Component: gtkhtml3Assignee: Matthew Barnes <mbarnes>
Status: CLOSED ERRATA QA Contact: Desktop QE <desktop-qa-list>
Severity: medium Docs Contact:
Priority: low    
Version: 7.2CC: mcrha, tpelka, vbenes
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:1ffe0bd8228dda9929b1f5901d756b580147a3af
Fixed In Version: gtkhtml3-4.8.5-2.el7 Doc Type: Bug Fix
Doc Text:
Cause: crash could happen when a link insert was initiated in the HTML message format Consequence: inserting an image and right after that a link could cause a crash due to no object type checking and casting an object into a type it was not, thus accessing object structure members with incorrect values. Fix: proper type checking had been added Result: application doesn't crash when a link is inserted right after inserting an image
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-19 07:59:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
patch to fix the crash none

Description Jiri Koten 2015-08-21 16:23:09 UTC 
Version-Release number of selected component:
gtkhtml3-4.8.5-1.el7

Additional info:
reporter:       libreport-2.1.11
Comment 1 Jiri Koten 2015-08-21 16:27:58 UTC 
Reproducer:

1) run gtkhtml-editor-test
2) Click Insert Image
3) Click Insert Link
Comment 2 Jiri Koten 2015-08-21 16:28:19 UTC 
Created attachment 1065638 [details]
File: backtrace
Comment 3 Milan Crha 2015-08-26 11:40:44 UTC 
Created attachment 1067229 [details]
patch to fix the crash
Comment 4 Milan Crha 2015-08-26 11:44:52 UTC 
The problem was that there was no type-checking, thus even the cursor was at an image object the code cast the structure to a text object, thus it was reading data which was not there. I added type-checking and fixed a cursor positioning, thus the changes in the URL description don't delete the image object.
Comment 7 errata-xmlrpc 2015-11-19 07:59:54 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2226.html