Bug 614973 - Tooltip buffer overflows in amsn
Summary: Tooltip buffer overflows in amsn
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: amsn
Version: 13
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Sander Hoentjen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:0a27c825321efe205a0fd3157f2...
: 617413 618907 622988 622992 625876 628197 (view as bug list)
Depends On: 595177
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-07-15 16:33 UTC by Ray Mansour
Modified: 2011-01-02 14:54 UTC (History)
15 users (show)

Fixed In Version: amsn-0.98.3-2.fc14
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-08-25 01:18:37 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: backtrace (18.18 KB, text/plain)
2010-07-15 16:33 UTC, Ray Mansour
no flags Details
Fix tooltip overflow (456 bytes, patch)
2010-07-30 13:01 UTC, Jaroslav Škarvada
no flags Details | Diff

Description Ray Mansour 2010-07-15 16:33:31 UTC
abrt 1.1.1 detected a crash.

architecture: x86_64
Attached file: backtrace
cmdline: wish /usr/bin/amsn
component: tk
crash_function: raise
executable: /usr/bin/wish8.5
global_uuid: 0a27c825321efe205a0fd3157f29dea0ec29b36c
kernel: 2.6.33.6-147.fc13.x86_64
package: tk-1:8.5.8-1.fc13
rating: 4
reason: Process /usr/bin/wish8.5 was killed by signal 6 (SIGABRT)
release: Fedora release 13 (Goddard)

Comment 1 Ray Mansour 2010-07-15 16:33:34 UTC
Created attachment 432138 [details]
File: backtrace

Comment 2 Jaroslav Škarvada 2010-07-27 07:43:03 UTC
Well, according to backtrace this looks more as amsn fault for me:

> #6  Tk_ConfigureIcon (clientData=<value optimized out>, interp=0x22c1110, 
>     objc=4, objv=<value optimized out>) at utils/linux/traydock/libtray.c:516

Looks like there is wrongly defined tooltip, causing the hang.

Can you provide steps to reproduce (e.g. which icon/tooltip you navigate before the hang)? The backtrace here seems not to be useful.

Comment 3 Jaroslav Škarvada 2010-07-27 07:44:03 UTC
*** Bug 617413 has been marked as a duplicate of this bug. ***

Comment 4 Jaroslav Škarvada 2010-07-28 07:18:35 UTC
*** Bug 618907 has been marked as a duplicate of this bug. ***

Comment 5 tonlhing 2010-07-28 15:46:04 UTC
Package: tk-1:8.5.8-1.fc13
Architecture: i686
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
1. Just leave the program running for a couple hours and then the program shutdown unnormally
2.
3.

Comment 6 juju 2010-07-29 23:41:26 UTC
Package: tk-1:8.5.8-1.fc13
Architecture: x86_64
OS Release: Fedora release 13 (Goddard)


How to reproduce
-----
1. some times without things to reproduct the bug
2. it crash !
3.

Comment 7 Jaroslav Škarvada 2010-07-30 13:00:20 UTC
OK, thanks for info.

Maybe I got it. It seems the tooltip buffer is only 256 bytes long, and amsn copy there notification of new messages without checking of bounds, thus it overflows sometimes.

Something like the following patch should solve this. Thus this is definitely amsn problem and I am reassigning this.

Comment 8 Jaroslav Škarvada 2010-07-30 13:01:21 UTC
Created attachment 435546 [details]
Fix tooltip overflow

Comment 9 Fedora Update System 2010-08-14 11:11:03 UTC
amsn-0.98.3-2.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/amsn-0.98.3-2.fc13

Comment 10 Fedora Update System 2010-08-14 11:11:09 UTC
amsn-0.98.3-2.fc14 has been submitted as an update for Fedora 14.
http://admin.fedoraproject.org/updates/amsn-0.98.3-2.fc14

Comment 11 Jaroslav Škarvada 2010-08-16 08:08:30 UTC
*** Bug 622992 has been marked as a duplicate of this bug. ***

Comment 12 Jaroslav Škarvada 2010-08-16 08:10:22 UTC
*** Bug 622988 has been marked as a duplicate of this bug. ***

Comment 13 Fedora Update System 2010-08-16 16:04:34 UTC
amsn-0.98.3-2.fc14 has been pushed to the Fedora 14 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update amsn'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/amsn-0.98.3-2.fc14

Comment 14 Fedora Update System 2010-08-20 02:25:08 UTC
amsn-0.98.3-2.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 arthurus314 2010-08-22 01:14:42 UTC
hi.
After the update 0.98.3-2.fc13 on Fedora 13, amsn crash suddenly after logging in with a segfault. I compiled the amsn sources to be sure that it's still working, and repeat the operation of update, and I had the same problem.

Comment 16 arthurus314 2010-08-22 01:21:40 UTC
(In reply to comment #15)
> I compiled the amsn sources to be sure that it's still
> working

When I said "compled sources", I mean that I tried the older version : amsn-0.98.3-1

Comment 17 Sander Hoentjen 2010-08-22 16:57:12 UTC
Please download and install the newest tktray from http://code.google.com/p/tktray/downloads/list if you can. If you want, I can make an rpm version of that package for you. Just let me know.

If it still happens with that version running amsn with gdb would help.

 $ gdb --args wish amsn
 (gdb) run
 [then when it segfaults, type]
 (gdb) bt
 (gdb) bt full

Comment 18 arthurus314 2010-08-22 17:15:00 UTC
It works with tktray1.3.9
Thank you ;)

Comment 19 Didier G 2010-08-22 20:06:18 UTC
Same problem after update to amsn-0.98.3-2.fc13.i686 and tktray-1.1-6.fc12.i686

Definitively need last version of tktray for Fedora 13.

Comment 20 Jaroslav Škarvada 2010-08-23 08:27:33 UTC
Confirmed, the crash happened only on i686 platform (not x86_64). With tktray-1.3.9 it don't crash. I didn't investigate this further, but for me it seems that it is not related to original subject of this bug, thus I would recommend closing this bug and opening new bug on it and/or pushing on bug #595177.

Comment 21 Jaroslav Škarvada 2010-08-23 08:48:16 UTC
There is abrt bug for it (bug #625747).

Comment 22 Jaroslav Škarvada 2010-08-23 09:13:37 UTC
*** Bug 625876 has been marked as a duplicate of this bug. ***

Comment 23 Fedora Update System 2010-08-25 01:18:32 UTC
amsn-0.98.3-2.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 24 Brandon McCaig 2010-08-25 13:37:53 UTC
This may not be relevant anymore, but I discovered that if I manually launched amsn from a terminal and passed it an argument of '--version' (which it doesn't seem to interpret as expected) it doesn't crash[1]... :\

[1] At least, not right away. I was able to view my buddy list and message a buddy.

Comment 25 Brandon McCaig 2010-08-25 13:51:08 UTC
Ah, I take it back... I just tried again it core-dumped... >_<

Comment 26 Jaroslav Škarvada 2010-09-06 09:12:11 UTC
*** Bug 628197 has been marked as a duplicate of this bug. ***

Comment 27 Baif 2010-12-23 03:19:19 UTC
I'm lookiing forward 0.98.4 on Fedora 14.

Comment 28 Sander Hoentjen 2011-01-02 14:54:17 UTC
(In reply to comment #27)
> I'm lookiing forward 0.98.4 on Fedora 14.

See https://bugzilla.redhat.com/show_bug.cgi?id=666070


Note You need to log in before you can comment on or make changes to this bug.