[konsole] [Bug 524271] Konsole crash on keyboard input

https://bugs.kde.org/show_bug.cgi?id=524271

--- Comment #4 from Nicolas Pomarede <[email protected]> ---
Hi

since posting this comment, I made more research and looked at the Konsole's
code based on the trace I got at the time of the crash.
I think the Fedora bug was closed by mistake and that it's really a bug
If you look at the backtrace and at these lines :
#15 0x00007ffb61e5920c in Konsole::Screen::writeToStream
(this=this@entry=0x55cc1114aeb0, decoder=decoder@entry=0x7fff730b4ef0,
startIndex=startIndex@entry=107, endIndex=endIndex@entry=7103,
options=options@entry=...) at
/usr/src/debug/konsole-26.04.2-1.fc44.x86_64/src/Screen.cpp:2050
        start = <optimized out>
        count = -43
        appendNewLine = true
        copied = <optimized out>
        y = 0
        top = 0
        left = <optimized out>
        bottom = 40
        right = <optimized out>

you can see that's count is set to -43.

so, in the above BR we can see that count is set to -43 when calling
Screen::copyLineToStream, this is certainly not right as the code in
copyLineToStream only expects -1 as a special negative case

else count seems to be expected to be >0

looking further, I found this patch

https://github.com/KDE/konsole/commit/fdfc223fb87c96816fba996c2fe900ff463d94f9

that's the one referenced in https://bugs.kde.org/show_bug.cgi?id=519276

but unfortunately the author of the patch says it was not backported to konsole
26.04, only to the upcoming 26.08 

as it is, the code to compute "count" in Screen::writeToStream in konsole 26.04
doesn't look ok to me, we can see that it can lead to negative value, it
doesn't check that it subtracts the smallest value from the biggest value.

I asked on Mageia devel mailing list if the above patch can be backported to
Mageia devel, and I will test if this fixes the issue

In the meantime I was also able to reproduce the crash (it's easier once you
find the possibly offending code). The "trick" seems to create a rectangular
selection going from right to left (and not left to right) to obtain a negative
value of "count"

 - in konsole, type a command that outputs lot of text (for example "ll" in a
directory with many files)

repeat :
 - then press ctrl+alt + left mouse button to start a rectangular selection in
the on-screen text
 - try to create a selection from the bottom right corner somewhere in the text
and move left+up to the desired upper left corner. 10 lines and 40 colums are
enough for me to crash
 - press "enter" key several times to advance in the history. This should
crash. If no crash, repeat with a new rectangular selection. what matters is to
create a selection from right to left to trigger a negative value of "count"

With this I was able to crash konsole several times in a row.

-- 
You are receiving this mail because:
You are watching all bug changes.