Bug 1296961 - [abrt] evince: g_type_check_instance_is_a(): evince killed by SIGSEGV
Summary: [abrt] evince: g_type_check_instance_is_a(): evince killed by SIGSEGV
Keywords:
Status: CLOSED DUPLICATE of bug 1376500
Alias: None
Product: Fedora
Classification: Fedora
Component: evince
Version: 23
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Caolan McNamara
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:37586024bf23bd2fb20233ecfeb...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-01-08 14:46 UTC by Dominic Cooper
Modified: 2016-10-14 09:00 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-14 09:00:00 UTC
Type: ---


Attachments (Terms of Use)
File: backtrace (34.74 KB, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: cgroup (190 bytes, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: core_backtrace (6.92 KB, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: dso_list (13.60 KB, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: environ (2.43 KB, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: exploitable (82 bytes, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: limits (1.29 KB, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: maps (62.64 KB, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: mountinfo (4.45 KB, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: namespaces (85 bytes, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: open_fds (2.17 KB, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: proc_pid_status (1013 bytes, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details
File: var_log_messages (293 bytes, text/plain)
2016-01-08 14:46 UTC, Dominic Cooper
no flags Details

Description Dominic Cooper 2016-01-08 14:46:17 UTC
Description of problem:
Whilst using evince on fillable forms, crashes when type multi-line text into a text field that exceeds some arbitrary (and unknown buffer size).

Reproduce:-  
(1)download http://hmctsformfinder.justice.gov.uk/courtfinder/forms/n215-eng.pdf
(2) in the box marked "Give the address where service effected" on the right hand side, either type in, or cut and paste multi-line text:-
"1234 High Street,
District Place,
Anytown,
Anycounty,
England,
PO1 1AS"
(3) Click away from this box on to another field.
(4) Quickly click back, and try to manipulate the text, by clicking the cursor with the mouse to a location ont he text, and delete some letters, enter carriage return, add letters, etc.
(5) Randomly (presumably when a buffer overrun kicks in, I am guessing) it will crash after a few seconds.

Version-Release number of selected component:
evince-3.18.2-3.fc23

Additional info:
reporter:       libreport-2.6.3
backtrace_rating: 4
cmdline:        evince /tmp/mozilla_dominic0/n215-eng.pdf
crash_function: g_type_check_instance_is_a
executable:     /usr/bin/evince
global_pid:     4303
kernel:         4.2.8-300.fc23.x86_64
runlevel:       N 5
type:           CCpp
uid:            1003

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 g_type_check_instance_is_a at gtype.c:4020
 #1 gtk_text_mark_get_buffer at gtktextmark.c:348
 #2 selection_data_free at gtktextview.c:7442
 #3 g_datalist_clear at gdataset.c:273
 #5 gtk_text_view_finalize at gtktextview.c:3597
 #7 ev_view_forall at ev-view.c:7001
 #8 ev_view_button_press_event at ev-view.c:5062
 #9 _gtk_marshal_BOOLEAN__BOXEDv at gtkmarshalers.c:131
 #10 _g_closure_invoke_va at gclosure.c:864
 #13 gtk_widget_event_internal at gtkwidget.c:7692

Potential duplicate: bug 1295493

Comment 1 Dominic Cooper 2016-01-08 14:46:22 UTC
Created attachment 1112897 [details]
File: backtrace

Comment 2 Dominic Cooper 2016-01-08 14:46:24 UTC
Created attachment 1112898 [details]
File: cgroup

Comment 3 Dominic Cooper 2016-01-08 14:46:25 UTC
Created attachment 1112899 [details]
File: core_backtrace

Comment 4 Dominic Cooper 2016-01-08 14:46:27 UTC
Created attachment 1112900 [details]
File: dso_list

Comment 5 Dominic Cooper 2016-01-08 14:46:28 UTC
Created attachment 1112901 [details]
File: environ

Comment 6 Dominic Cooper 2016-01-08 14:46:30 UTC
Created attachment 1112902 [details]
File: exploitable

Comment 7 Dominic Cooper 2016-01-08 14:46:31 UTC
Created attachment 1112903 [details]
File: limits

Comment 8 Dominic Cooper 2016-01-08 14:46:33 UTC
Created attachment 1112904 [details]
File: maps

Comment 9 Dominic Cooper 2016-01-08 14:46:35 UTC
Created attachment 1112905 [details]
File: mountinfo

Comment 10 Dominic Cooper 2016-01-08 14:46:36 UTC
Created attachment 1112906 [details]
File: namespaces

Comment 11 Dominic Cooper 2016-01-08 14:46:38 UTC
Created attachment 1112907 [details]
File: open_fds

Comment 12 Dominic Cooper 2016-01-08 14:46:39 UTC
Created attachment 1112908 [details]
File: proc_pid_status

Comment 13 Dominic Cooper 2016-01-08 14:46:40 UTC
Created attachment 1112909 [details]
File: var_log_messages

Comment 14 Fedora Admin XMLRPC Client 2016-10-14 08:08:53 UTC
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 15 Caolan McNamara 2016-10-14 09:00:00 UTC

*** This bug has been marked as a duplicate of bug 1376500 ***


Note You need to log in before you can comment on or make changes to this bug.