Bug 1296961

Summary: [abrt] evince: g_type_check_instance_is_a(): evince killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Dominic Cooper <dominic.cooper>
Component: evinceAssignee: Caolan McNamara <caolanm>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 23CC: feborges, mhatina, mkasik
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/ebfbbbb3e212697fb9aa6a1b4f33487a4ed13df7
Whiteboard: abrt_hash:37586024bf23bd2fb20233ecfeb9d87335db6366;VARIANT_ID=workstation;
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-10-14 09:00:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: mountinfo
none
File: namespaces
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description Dominic Cooper 2016-01-08 14:46:17 UTC
Description of problem:
Whilst using evince on fillable forms, crashes when type multi-line text into a text field that exceeds some arbitrary (and unknown buffer size).

Reproduce:-  
(1)download http://hmctsformfinder.justice.gov.uk/courtfinder/forms/n215-eng.pdf
(2) in the box marked "Give the address where service effected" on the right hand side, either type in, or cut and paste multi-line text:-
"1234 High Street,
District Place,
Anytown,
Anycounty,
England,
PO1 1AS"
(3) Click away from this box on to another field.
(4) Quickly click back, and try to manipulate the text, by clicking the cursor with the mouse to a location ont he text, and delete some letters, enter carriage return, add letters, etc.
(5) Randomly (presumably when a buffer overrun kicks in, I am guessing) it will crash after a few seconds.

Version-Release number of selected component:
evince-3.18.2-3.fc23

Additional info:
reporter:       libreport-2.6.3
backtrace_rating: 4
cmdline:        evince /tmp/mozilla_dominic0/n215-eng.pdf
crash_function: g_type_check_instance_is_a
executable:     /usr/bin/evince
global_pid:     4303
kernel:         4.2.8-300.fc23.x86_64
runlevel:       N 5
type:           CCpp
uid:            1003

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 g_type_check_instance_is_a at gtype.c:4020
 #1 gtk_text_mark_get_buffer at gtktextmark.c:348
 #2 selection_data_free at gtktextview.c:7442
 #3 g_datalist_clear at gdataset.c:273
 #5 gtk_text_view_finalize at gtktextview.c:3597
 #7 ev_view_forall at ev-view.c:7001
 #8 ev_view_button_press_event at ev-view.c:5062
 #9 _gtk_marshal_BOOLEAN__BOXEDv at gtkmarshalers.c:131
 #10 _g_closure_invoke_va at gclosure.c:864
 #13 gtk_widget_event_internal at gtkwidget.c:7692

Potential duplicate: bug 1295493

Comment 1 Dominic Cooper 2016-01-08 14:46:22 UTC
Created attachment 1112897 [details]
File: backtrace

Comment 2 Dominic Cooper 2016-01-08 14:46:24 UTC
Created attachment 1112898 [details]
File: cgroup

Comment 3 Dominic Cooper 2016-01-08 14:46:25 UTC
Created attachment 1112899 [details]
File: core_backtrace

Comment 4 Dominic Cooper 2016-01-08 14:46:27 UTC
Created attachment 1112900 [details]
File: dso_list

Comment 5 Dominic Cooper 2016-01-08 14:46:28 UTC
Created attachment 1112901 [details]
File: environ

Comment 6 Dominic Cooper 2016-01-08 14:46:30 UTC
Created attachment 1112902 [details]
File: exploitable

Comment 7 Dominic Cooper 2016-01-08 14:46:31 UTC
Created attachment 1112903 [details]
File: limits

Comment 8 Dominic Cooper 2016-01-08 14:46:33 UTC
Created attachment 1112904 [details]
File: maps

Comment 9 Dominic Cooper 2016-01-08 14:46:35 UTC
Created attachment 1112905 [details]
File: mountinfo

Comment 10 Dominic Cooper 2016-01-08 14:46:36 UTC
Created attachment 1112906 [details]
File: namespaces

Comment 11 Dominic Cooper 2016-01-08 14:46:38 UTC
Created attachment 1112907 [details]
File: open_fds

Comment 12 Dominic Cooper 2016-01-08 14:46:39 UTC
Created attachment 1112908 [details]
File: proc_pid_status

Comment 13 Dominic Cooper 2016-01-08 14:46:40 UTC
Created attachment 1112909 [details]
File: var_log_messages

Comment 14 Fedora Admin XMLRPC Client 2016-10-14 08:08:53 UTC
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 15 Caolan McNamara 2016-10-14 09:00:00 UTC

*** This bug has been marked as a duplicate of bug 1376500 ***