Re: problems with very long alt text
Jorge Arellano Cid <[email protected]>
| Newsgroups | gmane.comp.web.dillo.devel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Aug 25, 2011 at 02:36:56PM -0300, Jorge Arellano Cid wrote:
> On Thu, Aug 25, 2011 at 05:15:00PM +0000, corvid wrote:
> > Jorge wrote:
> > > On Thu, Aug 25, 2011 at 01:53:32AM +0000, corvid wrote:
> > > >
> > > > With remote stylesheets off and images off, opening
> > > > http://www.dillo.org/test/long_alt_text.html
> > > > and dragging the horizontal scrollbar left and right
> > > > for a little while will make my machine suddenly start
> > > > to page madly.
> > >
> > > Whoooooohooooo!
> > >
> > > Good catch: I got an instantaneous X server crash here.
> > >
> > > Will look into it.
> >
> > With XFT disabled, this page doesn't give me any memory difficulties.
>
> *it surprises me*
>
> I've found this:
>
> * fl_width() returns OK when called by FltkPlatform::textWidth()
> * dillo-2.2.1 also crashes my X server.
>
> With this little data I tend to think there's a bug in Dillo.
> Maybe a huge allocation request...
* There's no need to disable CSS nor images here to have a
crash.
To discard an utf8 kill-sequence, I changed the testcase into a
1106 'a' character repetition (attached). After applying the
attached debug-patch, it crashes consistently [1] with max_c=734
but not with max_c=733. I see the expected memory usage with
max_c=733 .
Is this also true in your machine?
*puzzled*
[1] Before and after rebooting the machine.
--
Cheers
Jorge.-
_______________________________________________
Dillo-dev mailing list
[email protected]
http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev
blk.html
(text/html, 1.3 KB)
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>The Near-Sighted Monkey</title> </head> <body> <img src= "http://27.media.tumblr.com/tumblr_lkdi74Lqcc1qbub56o1_500.jpg" alt="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" /></a> </body> </html>
dbg.diff
(text/x-diff, 656 B)
diff -r 20941d335027 src/html.cc
--- a/src/html.cc Wed Aug 24 11:52:01 2011 -0300
+++ b/src/html.cc Thu Aug 25 15:29:35 2011 -0300
@@ -2010,6 +2010,13 @@ DilloImage *a_Html_image_new(DilloHtml *
dFree(alt_ptr);
alt_ptr = dStrdup("[IMG]"); // Place holder for img_off mode
}
+ const size_t max_c = 733;
+ if (alt_ptr && strlen(alt_ptr) > max_c) {
+ char *old_ptr = alt_ptr;
+ alt_ptr = dStrndup(old_ptr, max_c);
+ dFree(old_ptr);
+ }
+
width_ptr = a_Html_get_attr_wdef(html, tag, tagsize, "width", NULL);
height_ptr = a_Html_get_attr_wdef(html, tag, tagsize, "height", NULL);
// Check for malicious values