Bug 152146 - lynx crashes on certain sites
Summary: lynx crashes on certain sites
Alias: None
Product: Fedora
Classification: Fedora
Component: lynx
Version: rawhide
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Tim Waugh
QA Contact: Brian Brock
: 152141 152142 152144 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2005-03-25 10:31 UTC by Ingo Molnar
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version: lynx-2.8.5-23
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2005-03-29 16:01:27 UTC
Type: ---

Attachments (Terms of Use)

Description Ingo Molnar 2005-03-25 10:31:40 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050323 Firefox/1.0.2 Fedora/1.0.2-1

Description of problem:
lynx crashes on e.g. http://news.google.com.

potential security issue.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. start lynx with http://news.google.com
2. see it crash

Actual Results:  lynx segfaulted.

Expected Results:  lynx should have displayed the page.

Additional info:

Comment 1 Ingo Molnar 2005-03-25 10:32:39 UTC
installed the debuginfo, here's the crash and backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x080b4e9a in HTML_end_element (me=0x96f70b0, element_number=91,
include=0x96f9318) at ./HTML.c:7086
7086                    for (; ptr && *ptr != '\0'; ptr++) {
(gdb) bt
#0  0x080b4e9a in HTML_end_element (me=0x96f70b0, element_number=91,
include=0x96f9318) at ./HTML.c:7086
#1  0x080ef9af in end_element (context=0x96f91e0, old_tag=0x8173ef0)
    at ../../../WWW/Library/Implementation/SGML.c:1178
#2  0x080f3a70 in SGML_character (context=0x96f91e0, c_in=62 '>')
    at ../../../WWW/Library/Implementation/SGML.c:3947
#3  0x080f7723 in SGML_write (context=0x96f91e0,
    str=0x8174a00 "mx\">México<option value=\"nz\">New Zealand<option
value=\"de_at\">Ãsterreich<option value=\"de_ch\">Schweiz<option
value=\"fr_ch\">Suisse<option value=\"uk\">U.K.<option value=\"us\"
selected>U.S.<option value=\"c"..., l=1412) at
#4  0x0810007c in HTCopy (anchor=0x96e4ce8, file_number=6, handle=0x0,
    at ../../../WWW/Library/Implementation/HTFormat.c:825
#5  0x080de044 in HTLoadHTTP (arg=0x96e4da0 "http://news.google.com/",
anAnchor=0x96e4ce8, format_out=0x95a1480,
    sink=0x0) at ../../../WWW/Library/Implementation/HTTP.c:1936
#6  0x080dc25b in HTLoadDocument (full_address=0x96e4ef0
"http://news.google.com/", anchor=0x96e4ce8,
    format_out=0x95a1480, sink=0x0) at
#7  0x080dccbc in HTLoadAbsolute (docaddr=0xbfc00748) at
#8  0x0806e503 in getfile (doc=0x816de40) at ./LYGetFile.c:830
#9  0x0807a4b4 in mainloop () at ./LYMainLoop.c:5546
#10 0x0807347e in main (argc=1, argv=Variable "argv" is not available.
) at ./LYMain.c:2116
#11 0x00259db6 in __libc_start_main () from /lib/tls/libc.so.6
#12 0x0804b811 in _start ()

Comment 2 Warren Togami 2005-03-27 00:36:43 UTC
*** Bug 152141 has been marked as a duplicate of this bug. ***

Comment 3 Warren Togami 2005-03-27 00:36:44 UTC
*** Bug 152142 has been marked as a duplicate of this bug. ***

Comment 4 Warren Togami 2005-03-27 00:37:05 UTC
*** Bug 152144 has been marked as a duplicate of this bug. ***

Comment 5 Ingo Molnar 2005-03-30 08:35:08 UTC
lynx-2.8.5-23 fixes all the crashes i could reproduce. Thanks.

Note You need to log in before you can comment on or make changes to this bug.