GNOME Bugzilla – Bug 389538
crash in Terminal: nothing
Last modified: 2008-10-12 12:22:12 UTC
Version: 2.16.1 What were you doing when the application crashed? nothing Distribution: Fedora Core release 6 (Rawhide) Gnome Release: 2.17.2 2006-11-07 (Red Hat, Inc) BugBuddy Version: 2.17.3 System: Linux 2.6.19-prep #2 Sun Dec 24 23:23:09 EST 2006 i686 X Vendor: The X.Org Foundation X Vendor Release: 70101000 Selinux: Enforcing Accessibility: Enabled Memory status: size: 69705728 vsize: 0 resident: 69705728 share: 0 rss: 25825280 rss_rlim: 0 CPU usage: start_time: 1167073236 rtime: 0 utime: 2851 stime: 0 cutime:1472 cstime: 0 timeout: 1379 it_real_value: 0 frequency: 4 Backtrace was generated from '/usr/bin/gnome-terminal' (no debugging symbols found) Using host libthread_db library "/lib/libthread_db.so.1". (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread -1208142128 (LWP 3748)] [New Thread -1214522480 (LWP 3755)] (no debugging symbols found) 0x0078b402 in ?? ()
+ Trace 96927
Thread 1 (Thread -1208142128 (LWP 3748))
----------- .xsession-errors (1840 sec old) --------------------- COMM_FAILURE Traceback (most recent call last): File "/usr/lib/python2.5/site-packages/orca/atspi.py", line 680, in __init__ self.accessible.ref() COMM_FAILURE Traceback (most recent call last): File "/usr/lib/python2.5/site-packages/orca/atspi.py", line 680, in __init__ self.accessible.ref() COMM_FAILURE Traceback (most recent call last): File "/usr/lib/python2.5/site-packages/orca/atspi.py", line 680, in __init__ self.accessible.ref() COMM_FAILURE ...Too much output, ignoring rest... --------------------------------------------------
Looks like a11y-related. Maybe they'll know. -->
Yes, I knew this bug. Someone tell us the bug by mail some days ago. I think it is a bug in vte. In vte_terminal_accessible_get_text, crashed in g_malloc, the parameter is unreasonable huge, even start_offset=560, end_offset=561.
The trace maybe more useful. Program received signal SIGABRT, Aborted.
+ Trace 104216
Thread NaN (LWP 4841)
Do you know how to reproduce this?
Created attachment 80863 [details] [review] Protect against building a <=0 length string. This papers over the bug (as is apparent, it is a missing guard) but does not explain how we got into that state in the first place.
Created attachment 80865 [details] [review] Actually protect against building a <= length string. -ENOCOFFEE
Committed the guard. (Safety first and I wish to work on vteaccess today ;) r1491: 2007-01-22 Chris Wilson <chris@chris-wilson.co.uk> Bug 389538 – crash in Terminal: nothing * src/vteaccess.c: (vte_terminal_accessible_get_text): Guard against negative length strings.
*** Bug 158238 has been marked as a duplicate of this bug. ***
*** Bug 365287 has been marked as a duplicate of this bug. ***
*** Bug 399648 has been marked as a duplicate of this bug. ***
*** Bug 421367 has been marked as a duplicate of this bug. ***
*** Bug 422862 has been marked as a duplicate of this bug. ***
*** Bug 438031 has been marked as a duplicate of this bug. ***
*** Bug 438389 has been marked as a duplicate of this bug. ***
*** Bug 438413 has been marked as a duplicate of this bug. ***
*** Bug 445209 has been marked as a duplicate of this bug. ***
*** Bug 444203 has been marked as a duplicate of this bug. ***
*** Bug 464765 has been marked as a duplicate of this bug. ***
*** Bug 477963 has been marked as a duplicate of this bug. ***
Dups are from <= g-t 2.16, plus patch committed -> FIXED.