Bug 211825

Description of problem:
liferea segfaulted.

Version-Release number of selected component (if applicable):
liferea-1.0.24-1.fc6.x86_64

How reproducible:
difficult

Steps to Reproduce:
1. browse feed with a image of some sort, not quite sure what.

  
Actual results:
segfault

Expected results:
no segfault

Additional info:
Core was generated by `/usr/bin/liferea-bin'.
Program terminated with signal 11, Segmentation fault.
#0  IA__gdk_cairo_set_source_pixbuf (cr=0xc01d10, pixbuf=<value optimized out>,
pixbuf_x=38, pixbuf_y=329) at gdkcairo.c:201
201                   MULT(q[0], p[2], p[3], t1);
(gdb) thread apply all bt

Thread 5 (process 25256):
#0  0x000000374b40a416 in pthread_cond_wait@@GLIBC_2.3.2 () from
/lib64/libpthread.so.0
#1  0x000000374f4113c5 in g_async_queue_pop_intern_unlocked (queue=0x6a7a40,
try=<value optimized out>, 
    end_time=<value optimized out>) at gasyncqueue.c:334
#2  0x000000374f41174e in IA__g_async_queue_pop (queue=0x6a7a40) at
gasyncqueue.c:374
#3  0x000000000044d3a6 in download_thread_main (data=<value optimized out>) at
update.c:270
#4  0x000000374f448f24 in g_thread_create_proxy (data=0x6a2f50) at gthread.c:553
#5  0x000000374b406305 in start_thread () from /lib64/libpthread.so.0
#6  0x000000374a8cd62d in clone () from /lib64/libc.so.6
#7  0x0000000000000000 in ?? ()

Thread 4 (process 25257):
#0  0x000000374a8c6be2 in __select_nocancel () from /lib64/libc.so.6
#1  0x000000000044ecd4 in NetPoll (cur_ptr=0x41401020, my_socket=0x41400fd4,
rw=1) at netio.c:109
#2  0x000000000044f202 in NetIO (my_socket=0x41400fd4, host=<value optimized
out>, url=0x2aaab000096f "/favicon.ico", 
    cur_ptr=0x41401020, authdata=0x0, httpproto=1, suppressoutput=0) at netio.c:486
#3  0x0000000000450c86 in DownloadFeed (url=0x2aaab000096f "/favicon.ico",
cur_ptr=0x41401020, suppressoutput=0)
    at netio.c:1036
#4  0x0000000000451054 in downloadlib_process_url (request=0xcbf290) at netio.c:1087
#5  0x000000000044d274 in download_process (request=0xcbf290) at update.c:140
#6  0x000000000044d3d2 in download_thread_main (data=<value optimized out>) at
update.c:282
#7  0x000000374f448f24 in g_thread_create_proxy (data=0x6a3280) at gthread.c:553
#8  0x000000374b406305 in start_thread () from /lib64/libpthread.so.0
#9  0x000000374a8cd62d in clone () from /lib64/libc.so.6
#10 0x0000000000000000 in ?? ()

Thread 3 (process 25258):
#0  0x000000374a8c6be2 in __select_nocancel () from /lib64/libc.so.6
#1  0x000000000044ecd4 in NetPoll (cur_ptr=0x41e02020, my_socket=0x41e01fd4,
rw=1) at netio.c:109
#2  0x000000000044f202 in NetIO (my_socket=0x41e01fd4, host=<value optimized
out>, url=0xa64685 "/favicon.ico", 
    cur_ptr=0x41e02020, authdata=0x0, httpproto=1, suppressoutput=0) at netio.c:486
#3  0x0000000000450c86 in DownloadFeed (url=0xa64685 "/favicon.ico",
cur_ptr=0x41e02020, suppressoutput=0) at netio.c:1036
#4  0x0000000000451054 in downloadlib_process_url (request=0xb6c110) at netio.c:1087
#5  0x000000000044d274 in download_process (request=0xb6c110) at update.c:140
#6  0x000000000044d3d2 in download_thread_main (data=<value optimized out>) at
update.c:282
#7  0x000000374f448f24 in g_thread_create_proxy (data=0x6a33e0) at gthread.c:553
#8  0x000000374b406305 in start_thread () from /lib64/libpthread.so.0
#9  0x000000374a8cd62d in clone () from /lib64/libc.so.6
#10 0x0000000000000000 in ?? ()

Thread 2 (process 25259):
#0  0x000000374a8bfcbb in __read_nocancel () from /lib64/libc.so.6
#1  0x000000374a8699e7 in _IO_new_file_underflow () from /lib64/libc.so.6
#2  0x000000374a8686ce in _IO_file_xsgetn_internal () from /lib64/libc.so.6
#3  0x000000374a85f1f2 in fread () from /lib64/libc.so.6
#4  0x000000000044faa0 in NetIO (my_socket=0x42802fd4, host=<value optimized out>, 
    url=0x2aaab00070c0 "\"26bd0c-3942d-45375152\"", cur_ptr=0x42803020,
authdata=0x0, httpproto=1, suppressoutput=0)
---Type <return> to continue, or q <return> to quit---
    at netio.c:921
#5  0x0000000000450c86 in DownloadFeed (url=0x2aaab00044a9 "/daily",
cur_ptr=0x42803020, suppressoutput=0) at netio.c:1036
#6  0x0000000000451054 in downloadlib_process_url (request=0xaa26e0) at netio.c:1087
#7  0x000000000044d274 in download_process (request=0xaa26e0) at update.c:140
#8  0x000000000044d3d2 in download_thread_main (data=<value optimized out>) at
update.c:282
#9  0x000000374f448f24 in g_thread_create_proxy (data=0x6a3540) at gthread.c:553
#10 0x000000374b406305 in start_thread () from /lib64/libpthread.so.0
#11 0x000000374a8cd62d in clone () from /lib64/libc.so.6
#12 0x0000000000000000 in ?? ()

Thread 1 (process 25254):
#0  IA__gdk_cairo_set_source_pixbuf (cr=0xc01d10, pixbuf=<value optimized out>,
pixbuf_x=38, pixbuf_y=329) at gdkcairo.c:201
#1  0x0000003750c7e4fa in gtk_cell_renderer_pixbuf_render (cell=0x6969c0,
window=0x990ee0, widget=0x716180, 
    background_area=<value optimized out>, cell_area=0x7fff30f2a7f0,
expose_area=<value optimized out>, flags=0)
    at gtkcellrendererpixbuf.c:678
#2  0x0000003750e1f8d3 in gtk_tree_view_column_cell_process_action
(tree_column=0x702490, window=0x990ee0, 
    background_area=0x7fff30f2aa10, cell_area=0x7fff30f2aa00, flags=0, action=0,
expose_area=0x7fff30f2b244, 
    focus_rectangle=0x0, editable_widget=0x0, event=0x0, path_string=0x0) at
gtktreeviewcolumn.c:2768
#3  0x0000003750e20551 in _gtk_tree_view_column_cell_render
(tree_column=0x702490, window=0x990ee0, 
    background_area=0x7fff30f2aa10, cell_area=0x7fff30f2aa00,
expose_area=0x7fff30f2b244, flags=0)
    at gtktreeviewcolumn.c:3101
#4  0x0000003750e1a5e6 in gtk_tree_view_expose (widget=0x716180,
event=0x7fff30f2b230) at gtktreeview.c:4540
#5  0x0000003750d3015d in _gtk_marshal_BOOLEAN__BOXED (closure=0x6ac680,
return_value=0x7fff30f2ad30, 
    n_param_values=<value optimized out>, param_values=0x7fff30f2ae30,
invocation_hint=<value optimized out>, 
    marshal_data=0x3750e19120) at gtkmarshalers.c:84
#6  0x000000374f80b16a in IA__g_closure_invoke (closure=0x6ac680,
return_value=0x7fff30f2ad30, n_param_values=2, 
    param_values=0x7fff30f2ae30, invocation_hint=0x7fff30f2acf0) at gclosure.c:490
#7  0x000000374f81b9dd in signal_emit_unlocked_R (node=0x6ac6f0, detail=0,
instance=0x716180, 
    emission_return=0x7fff30f2b050, instance_and_params=0x7fff30f2ae30) at
gsignal.c:2476
#8  0x000000374f81c5ef in IA__g_signal_emit_valist (instance=0x716180,
signal_id=<value optimized out>, detail=0, 
    var_args=0x7fff30f2b0b0) at gsignal.c:2207
#9  0x000000374f81ca03 in IA__g_signal_emit (instance=0x30, signal_id=11134800,
detail=24) at gsignal.c:2241
#10 0x0000003750e2d63e in gtk_widget_event_internal (widget=0x716180,
event=0x7fff30f2b230) at gtkwidget.c:3911
#11 0x0000003750d2aa10 in IA__gtk_main_do_event (event=0x7fff30f2b230) at
gtkmain.c:1380
#12 0x0000003751631f8a in gdk_window_process_updates_internal (window=0x990ee0)
at gdkwindow.c:2324
#13 0x00000037516321cb in IA__gdk_window_process_all_updates () at gdkwindow.c:2387
#14 0x0000003750ca7c05 in gtk_container_idle_sizer (data=<value optimized out>)
at gtkcontainer.c:1113
#15 0x000000374f42cf44 in IA__g_main_context_dispatch (context=0x69ac30) at
gmain.c:2045
#16 0x000000374f42fd7d in g_main_context_iterate (context=0x69ac30, block=1,
dispatch=1, self=<value optimized out>)
    at gmain.c:2677
#17 0x000000374f43008a in IA__g_main_loop_run (loop=0x9cdc30) at gmain.c:2881
#18 0x0000003750d2abf3 in IA__gtk_main () at gtkmain.c:1001
#19 0x0000000000435481 in main (argc=1, argv=0x7fff30f2b7f8) at main.c:295