Bug 152146

Summary:	lynx crashes on certain sites
Product:	[Fedora] Fedora	Reporter:	Ingo Molnar <mingo>
Component:	lynx	Assignee:	Tim Waugh <twaugh>
Status:	CLOSED RAWHIDE	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	redhat-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:	lynx-2.8.5-23	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-03-29 16:01:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ingo Molnar 2005-03-25 10:31:40 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050323 Firefox/1.0.2 Fedora/1.0.2-1

Description of problem:
lynx crashes on e.g. http://news.google.com.

potential security issue.

Version-Release number of selected component (if applicable):
lynx-2.8.5-22

How reproducible:
Always

Steps to Reproduce:
1. start lynx with http://news.google.com
2. see it crash

Actual Results:  lynx segfaulted.

Expected Results:  lynx should have displayed the page.

Additional info:

Comment 1 Ingo Molnar 2005-03-25 10:32:39 UTC

installed the debuginfo, here's the crash and backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x080b4e9a in HTML_end_element (me=0x96f70b0, element_number=91,
include=0x96f9318) at ./HTML.c:7086
7086                    for (; ptr && *ptr != '\0'; ptr++) {
(gdb) bt
#0  0x080b4e9a in HTML_end_element (me=0x96f70b0, element_number=91,
include=0x96f9318) at ./HTML.c:7086
#1  0x080ef9af in end_element (context=0x96f91e0, old_tag=0x8173ef0)
    at ../../../WWW/Library/Implementation/SGML.c:1178
#2  0x080f3a70 in SGML_character (context=0x96f91e0, c_in=62 '>')
    at ../../../WWW/Library/Implementation/SGML.c:3947
#3  0x080f7723 in SGML_write (context=0x96f91e0,
    str=0x8174a00 "mx\">MÃ©xico<option value=\"nz\">New Zealand<option
value=\"de_at\">Ãsterreich<option value=\"de_ch\">Schweiz<option
value=\"fr_ch\">Suisse<option value=\"uk\">U.K.<option value=\"us\"
selected>U.S.<option value=\"c"..., l=1412) at
../../../WWW/Library/Implementation/SGML.c:4411
#4  0x0810007c in HTCopy (anchor=0x96e4ce8, file_number=6, handle=0x0,
sink=0x96f5b18)
    at ../../../WWW/Library/Implementation/HTFormat.c:825
#5  0x080de044 in HTLoadHTTP (arg=0x96e4da0 "http://news.google.com/",
anAnchor=0x96e4ce8, format_out=0x95a1480,
    sink=0x0) at ../../../WWW/Library/Implementation/HTTP.c:1936
#6  0x080dc25b in HTLoadDocument (full_address=0x96e4ef0
"http://news.google.com/", anchor=0x96e4ce8,
    format_out=0x95a1480, sink=0x0) at
../../../WWW/Library/Implementation/HTAccess.c:688
#7  0x080dccbc in HTLoadAbsolute (docaddr=0xbfc00748) at
../../../WWW/Library/Implementation/HTAccess.c:1112
#8  0x0806e503 in getfile (doc=0x816de40) at ./LYGetFile.c:830
#9  0x0807a4b4 in mainloop () at ./LYMainLoop.c:5546
#10 0x0807347e in main (argc=1, argv=Variable "argv" is not available.
) at ./LYMain.c:2116
#11 0x00259db6 in __libc_start_main () from /lib/tls/libc.so.6
#12 0x0804b811 in _start ()
(gdb)

Comment 2 Warren Togami 2005-03-27 00:36:43 UTC

*** Bug 152141 has been marked as a duplicate of this bug. ***

Comment 3 Warren Togami 2005-03-27 00:36:44 UTC

*** Bug 152142 has been marked as a duplicate of this bug. ***

Comment 4 Warren Togami 2005-03-27 00:37:05 UTC

*** Bug 152144 has been marked as a duplicate of this bug. ***

Comment 5 Ingo Molnar 2005-03-30 08:35:08 UTC

lynx-2.8.5-23 fixes all the crashes i could reproduce. Thanks.