[konsole] [Bug 432376] Issues with reflow (links and highlighting)

[Carlos Alves]

https://bugs.kde.org/show_bug.cgi?id=432376

--- Comment #4 from Carlos Alves <cbc.alves at gmail.com> ---
It does 'insert' in array size(), it is intended to, and it will never crash
because when it is size() the 'insert' will turn into 'append', it is in
'QVarLengthArray' class documentation.
Characters in konsole doesn't have high or size attribute to be changed in
reflow.

I'll try to replicate and test this bug, here.

(In reply to Martin Sandsmark from comment #3)
> just tried to build with asan and ubsan and it crashes immediately when it
> tries to reflow, assuming it is related:
> 
> ==131591==ERROR: AddressSanitizer: heap-use-after-free on address
> 0x60800002f520 at pc 0x7f38df17a22b bp 0x7ffc78b00f80 sp 0x7ffc78b00f70
> READ of size 1 at 0x60800002f520 thread T0
>     #0 0x7f38df17a22a in QVarLengthArray<unsigned char, 64>::insert(unsigned
> char const*, int, unsigned char const&)
> (/home/sandsmark/src/konsole/build/bin/libkdeinit5_konsole.so+0x167c22a)
>     #1 0x7f38df16c48c in QVarLengthArray<unsigned char, 64>::insert(int,
> unsigned char const&)
> (/home/sandsmark/src/konsole/build/bin/libkdeinit5_konsole.so+0x166e48c)
>     #2 0x7f38df13c12d in Konsole::Screen::resizeImage(int, int)
> ../src/Screen.cpp:479
>     #3 0x7f38df0b9698 in Konsole::Emulation::setImageSize(int, int)
> ../src/Emulation.cpp:317
>     #4 0x7f38deed7843 in Konsole::Session::updateTerminalSize()
> ../src/session/Session.cpp:753
>     #5 0x7f38deed6495 in Konsole::Session::onViewSizeChange(int, int)
> ../src/session/Session.cpp:726
>     #6 0x7f38def1afe5 in QtPrivate::FunctorCall<QtPrivate::IndexesList<0,
> 1>, QtPrivate::List<int, int>, void, void (Konsole::Session::*)(int,
> int)>::call(void (Konsole::Session::*)(int, int), Konsole::Session*, void**)
> /usr/include/qt/QtCore/qobjectdefs_impl.h:152
> 
> 0x60800002f520 is located 0 bytes inside of 89-byte region
> [0x60800002f520,0x60800002f579)
> freed by thread T0 here:
>     #0 0x7f38e0f9f0e9 in __interceptor_free
> /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:123
>     #1 0x7f38df171e80 in QVarLengthArray<unsigned char, 64>::realloc(int,
> int) (/home/sandsmark/src/konsole/build/bin/libkdeinit5_konsole.so+0x1673e80)
>     #2 0x7f38df1683fb in QVarLengthArray<unsigned char, 64>::resize(int)
> (/home/sandsmark/src/konsole/build/bin/libkdeinit5_konsole.so+0x166a3fb)
>     #3 0x7f38df17a1d8 in QVarLengthArray<unsigned char, 64>::insert(unsigned
> char const*, int, unsigned char const&)
> (/home/sandsmark/src/konsole/build/bin/libkdeinit5_konsole.so+0x167c1d8)
>     #4 0x7f38df16c48c in QVarLengthArray<unsigned char, 64>::insert(int,
> unsigned char const&)
> (/home/sandsmark/src/konsole/build/bin/libkdeinit5_konsole.so+0x166e48c)
>     #5 0x7f38df13c12d in Konsole::Screen::resizeImage(int, int)
> ../src/Screen.cpp:479
>     #6 0x7f38df0b9698 in Konsole::Emulation::setImageSize(int, int)
> ../src/Emulation.cpp:317
> 
> previously allocated by thread T0 here:
>     #0 0x7f38e0f9f459 in __interceptor_malloc
> /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
>     #1 0x7f38df171901 in QVarLengthArray<unsigned char, 64>::realloc(int,
> int) (/home/sandsmark/src/konsole/build/bin/libkdeinit5_konsole.so+0x1673901)
>     #2 0x7f38df1683fb in QVarLengthArray<unsigned char, 64>::resize(int)
> (/home/sandsmark/src/konsole/build/bin/libkdeinit5_konsole.so+0x166a3fb)
>     #3 0x7f38df13da7b in Konsole::Screen::resizeImage(int, int)
> ../src/Screen.cpp:511
>     #4 0x7f38df0b9698 in Konsole::Emulation::setImageSize(int, int)
> ../src/Emulation.cpp:317

-- 
You are receiving this mail because:
You are the assignee for the bug.