Bugtraq mangleme causes Konqueror to SegFault

[Albert Cervera Areny]

A Divendres 22 Octubre 2004 12:35, Waldo Bastian va escriure:
> On Friday 22 October 2004 02:02, Albert Cervera Areny wrote:
> > I haven't seen anything in the archives (I've just subscribed to the
> > list), so I've thought I should share this. I've tried the recently (on
> > Monday) announced program (.cgi) used to test browsers sending them
> > malformed HTML. As the reported didn't test it with konqueror I was just
> > curious.
> >
> > During the test konqueror crashed once, though I have to say haven't
> > tested it very much. Attached is the file that crashes konqueror. I
> > didn't want to report a bug in bugs.kde.org as it is possible that there
> > are other crashes.. If nobody has installed the program but you are
> > interested, I can make lots of tests and send those files that make it
> > crash.
> >
> > Tested against 3.3.0 and recent CVS.
>
> It reloads rather quickly but doesn't crash here. Do you have a backtrace
> of your crash?
>
> Cheers,
> Waldo

I looked at it with more time and realized that it only crashes with 3.3.0 (I 
logged in with the CVS version but by mistake used konqueror 3.3.0 instead 
that's why it seemed that it also crashed with CVS version). Anyway, here is 
the backtrace for 3.3.0 with Debian packages.

I've been doing some more tests for konqueror cvs and haven't seen a crash. 
Good job! I'll try again for 3.3.0 however, and report if there is any other 
problem.
 

Backtrace:

Using host libthread_db library "/lib/tls/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 1097118016 (LWP 5505)]
[KCrash handler]
#3  0x41c83aea in QPtrDict<QWidget>::deleteItem () from /usr/lib/libkhtml.so.4
#4  0x41c83bec in QPtrDict<QWidget>::deleteItem () from /usr/lib/libkhtml.so.4
#5  0x41cb105c in DOM::removeForbidden () from /usr/lib/libkhtml.so.4
#6  0x41cb2676 in DOM::removeForbidden () from /usr/lib/libkhtml.so.4
#7  0x41c8a5bf in QPtrDict<QWidget>::deleteItem () from /usr/lib/libkhtml.so.4
#8  0x41c9d11a in KStaticDeleter<QPtrList<DOM::DocumentImpl> 
>::~KStaticDeleter
    () from /usr/lib/libkhtml.so.4
#9  0x41ca51c0 in KStaticDeleter<QPtrList<DOM::DocumentImpl> 
>::~KStaticDeleter
    () from /usr/lib/libkhtml.so.4
#10 0x41ca3b45 in KStaticDeleter<QPtrList<DOM::DocumentImpl> 
>::~KStaticDeleter
    () from /usr/lib/libkhtml.so.4
#11 0x41ca47ec in KStaticDeleter<QPtrList<DOM::DocumentImpl> 
>::~KStaticDeleter
    () from /usr/lib/libkhtml.so.4
#12 0x41c46ba7 in KHTMLPart::write () from /usr/lib/libkhtml.so.4
#13 0x41c4421c in KHTMLPart::slotData () from /usr/lib/libkhtml.so.4
#14 0x41c6153b in KHTMLPart::qt_invoke () from /usr/lib/libkhtml.so.4
#15 0x40d2d52c in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#16 0x402f6464 in KIO::TransferJob::data () from /usr/lib/libkio.so.4
#17 0x402e1de3 in KIO::TransferJob::slotData () from /usr/lib/libkio.so.4
#18 0x402f69b4 in KIO::TransferJob::qt_invoke () from /usr/lib/libkio.so.4
#19 0x40d2d52c in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#20 0x402d3dfa in KIO::SlaveInterface::data () from /usr/lib/libkio.so.4
#21 0x402d2366 in KIO::SlaveInterface::dispatch () from /usr/lib/libkio.so.4
#22 0x402d20c9 in KIO::SlaveInterface::dispatch () from /usr/lib/libkio.so.4
#23 0x402cfafb in KIO::Slave::gotInput () from /usr/lib/libkio.so.4
#24 0x402d1818 in KIO::Slave::qt_invoke () from /usr/lib/libkio.so.4
#25 0x40d2d52c in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#26 0x40d2d68d in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#27 0x4106beb2 in QSocketNotifier::activated () from /usr/lib/libqt-mt.so.3
#28 0x40d49cd0 in QSocketNotifier::event () from /usr/lib/libqt-mt.so.3
#29 0x40cd0bcf in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
#30 0x40cd01ce in QApplication::notify () from /usr/lib/libqt-mt.so.3
#31 0x408721a3 in KApplication::notify () from /usr/lib/libkdecore.so.4
#32 0x40cc05da in QEventLoop::activateSocketNotifiers ()
   from /usr/lib/libqt-mt.so.3
#33 0x40c79c03 in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
#34 0x40ce2f28 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
#35 0x40ce2dd8 in QEventLoop::exec () from /usr/lib/libqt-mt.so.3
#36 0x40cd0e21 in QApplication::exec () from /usr/lib/libqt-mt.so.3
#37 0x40074b5c in kdemain () from /usr/lib/libkdeinit_konqueror.so
#38 0x0804861b in ?? ()
#39 0x00000002 in ?? ()
#40 0xbffffaa4 in ?? ()
#41 0xbffffaa4 in ?? ()
#42 0x413e97f8 in __libc_start_main () from /lib/tls/libc.so.6
#43 0x4150bfcc in ?? () from /lib/tls/libc.so.6