GNOME Bugzilla – Bug 631597
Segmentation fault in append_escaped_text
Last modified: 2015-04-28 15:24:00 UTC
Created attachment 171888 [details] GDB session with "bt full" after segfault I have encountered segfault in recent Gajim 0.14 application. Please have a look at the attachment with backtrace. FreeBSD 8.1-RELEASE, Glib 2.24.2, GTK 2.20.1, PyGTK 2.17.0. The error appears only then I am using "ru_RU.KOI8-R" locale, LC_ALL="C" produces no errors. The bug was originally reported in http://trac.gajim.org/ticket/5959
It appears you have non-utf8 text here. This is not the fault of append_escaped text, but of whoever passed non-utf8 text down there. Looks like it may be coming from a gtkbuilder ui file, or from translations ?
(In reply to comment #1) > Looks like it may be > coming from a gtkbuilder ui file, or from translations ? Well, as I can guess from the backtrace, "buggy" string is in "data/gui/filetransfers.ui". More precisely - http://trac.gajim.org/browser/data/gui/filetransfers.ui#L198, but this ui file is in english. So, the bug comes from translation?
(In reply to comment #2) > So, the bug comes from translation? I have just carried out small test: "ru_RU.UTF-8" locale produces no errors. Russian .po file seems to be valid utf-8. May be glib internals is somehow affected by locale settings? (I can only conjecture.)
Looks like the application mistakenly passed a KOI8-R encoded string to GTK. You could probably track this down, or at least get closer, by breaking on g_logv() and investigating the earliest warning you get prior to the crash. By the way, append_escaped_text() is extra vulnerable to invalid UTF-8 because of this: > while (p != end) { ... } Judging by the backtrace, g_utf8_next_char() skipped slightly past end, making the loop go on until it hit an invalid address. This can also happen if you pass a valid UTF-8 string with a too short length argument. I think it'd make sense to change it to > while (p < end) { ... } which would make it more robust and more readable, since the existing assumption is made explicit.
Created attachment 302518 [details] [review] 0001-gmarkup-Make-append_escaped_text-slightly-more-robus.patch Make append_escaped_text() slightly more robust.
Review of attachment 302518 [details] [review]: makes sense to me
Pushed to master. Resolving as NOTGNOME since bug as reported was not caused by glib.