After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 318192 - css_value_to_string may return NULL which will get used without checking
css_value_to_string may return NULL which will get used without checking
Status: RESOLVED FIXED
Product: gtkhtml2
Classification: Deprecated
Component: CSS Parser
unspecified
Other All
: High critical
: ---
Assigned To: Rodney Dawes
Rodney Dawes
Depends on:
Blocks:
 
 
Reported: 2005-10-07 11:18 UTC by Pawel Salek
Modified: 2005-10-26 02:04 UTC
See Also:
GNOME target: ---
GNOME version: 2.7/2.8


Attachments
Proposed patch (940 bytes, patch)
2005-10-07 11:20 UTC, Pawel Salek
committed Details | Review

Description Pawel Salek 2005-10-07 11:18:33 UTC
Steps to reproduce:
Invalid CSS will crash the widget because 
css_value_to_string() will return NULL if value is CSS_VALUE_LIST. Example entry is:

font-family: 10px/14px verdana, trebuchet, sans-serif;

i.e. when specification is for "font:" but the list is preceeded with
"font-family:" instead.


Stack trace:
0x004713f9 in strcat () from /lib/tls/libc.so.6
(gdb) where
  • #0 strcat
    from /lib/tls/libc.so.6
  • #1 css_matcher_apply_rule
    at cssmatcher.c line 1402
  • #2 css_matcher_get_style
    at cssmatcher.c line 2817
  • #3 html_document_node_inserted_traverser
    at htmldocument.c line 311
  • #4 html_document_new_node
    at htmldocument.c line 474


Other information:
I will attach a patch that checks the returned value but I am not sure whether
that's the intended behaviour, perhaps css_value_to_string() should not return NULL?
Comment 1 Pawel Salek 2005-10-07 11:20:07 UTC
Created attachment 53175 [details] [review]
Proposed patch

This patch checks the return value of css_value_to_string() and avoids the
segmentation fault.
Comment 2 Pawel Salek 2005-10-07 14:32:47 UTC
I should add this happens for current source as in the CVS repository.
Comment 3 Rodney Dawes 2005-10-26 02:04:33 UTC
Committed to CVS. Thanks for the patch.