Re: Crash bug and proposed patch

Kalle Olavi Niemitalo <[email protected]> Wed, 13 Sep 2006 23:24:35 +0300

Newsgroups	gmane.comp.web.links
Message-ID	<[email protected]>

joey <[email protected]> writes:

> I recently ran into a crash bug with elinks. I've provided a backtrace,
> a sample document, and a proposed patch. Basically, html_special() in
> src/document/html/renderer.c sets document->refresh without checking
> to see if document is a valid pointer first (inside the SP_REFRESH
> case).

The patch makes sense to me, but I hope someone else will review
it, because I don't know the rendering code very well.  I also
fear the crash might be a symptom of a deeper problem, but then
again there already are a few "if (document)" checks in
html_special, so perhaps my suspicion is unfounded.

The SP_FRAMESET case uses document->frame_desc without checking
whether document is NULL.  It would be interesting to know if
that too can be used to crash ELinks.

> 3) crash.html - The file that exposed the bug

Here is a much shorter one.  Let's see if this one gets through
the spamassassin.

_______________________________________________
elinks-dev mailing list
[email protected]
http://linuxfromscratch.org/mailman/listinfo/elinks-dev

crash.html (text/html, 219 B)

<html>
 <head>
  <title>Refresh in a table cell</title>
 </head>
 <body>
  <table>
   <tr>
    <td>
     <body>
      <meta http-equiv="Refresh" content="90">
     </body>
    </td>
   </tr>
  </table>
 </body>
</html>

signature.asc (application/pgp-signature, 188 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFFCGkLHm9IGt60eMgRAtgvAJ9u9k+a860aImTWIHcxijVpia2UugCfeEqN
PVpLG/P5evZkZ5gLgo23G2s=
=kelh
-----END PGP SIGNATURE-----