Your message dated Mon, 23 May 2016 13:19:45 +0000 with message-id <[email protected]> and subject line Bug#820162: fixed in w3m 0.5.3-28 has caused the Debian Bug report #820162, regarding w3m: SEGFAULT on bogus HTML to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 820162: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820162 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: w3m Version: 0.5.3-19 Severity: important Tags: security Dear Maintainer, Please find attached a tarball which contains two files, a generated one, and one which has been reduced to the smallest possible test-case. Each of those files causes w3m to segfault when run as follows: cat $file | w3m -dump The crash is a segfault, which is probably not exploitable but may be to somebody who puts in more effort than I did! On the face of it this is a minor/normal bug, until you consider the case of users who run mutt and use w3m to convert HTML emails to plaintext, that situation is common and as such I've raised the severity. The crash is in some horrible code which is converting the file to UTF-8, as the following backtrace shows: (gdb) bt #0 wc_any_to_ucs (cc=...) at ucs.c:274 #1 0x000000000070d73a in wc_push_to_utf8 (os=os@entry=0xed8940, cc=..., st=st@entry=0x7fff11c174c0) at utf8.c:276 #2 0x00000000006d4b9b in wc_conv_to_ces (ces=0, is=0xed8960) at conv.c:93 #3 wc_Str_conv (is=is@entry=0xed8960, f_ces=<optimized out>, t_ces=t_ces@entry=3178565) at conv.c:23 #4 0x00000000004ba1ea in _saveBuffer (buf=buf@entry=0xed9e00, l=0xeddf60, f=0x7efc1c5ce2a0 <_IO_2_1_stdout_>, cont=cont@entry=0) at file.c:7595 #5 0x00000000004ba726 in saveBuffer (buf=buf@entry=0xed9e00, f=<optimized out>, cont=cont@entry=0) at file.c:7613 #6 0x0000000000414ec2 in do_dump (buf=0xed9e00) at main.c:1337 #7 0x0000000000407b25 in main (argc=-1, argv=0xed8a00, envp=0x8800) at main.c:1043 Mitigating factors? Interestingly the following does NOT crash: w3m -dump $file Steve -- https://www.steve.org.uk/ -- System Information: Debian Release: 8.3 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages w3m depends on: ii libc6 2.19-18+deb8u3 ii libgc1c2 1:7.2d-6.4 ii libgpm2 1.20.4-6.1+b2 ii libssl1.0.0 1.0.1k-3+deb8u4 ii libtinfo5 5.9+20140913-1+b1 ii zlib1g 1:1.2.8.dfsg-2+b1 Versions of packages w3m recommends: ii ca-certificates 20141019+deb8u1 Versions of packages w3m suggests: pn cmigemo <none> ii man-db 2.7.0.2-5 ii mime-support 3.58 pn w3m-el <none> pn w3m-img <none> -- no debconf information
crash.tar.gz
Description: application/gzip
--- End Message ---
--- Begin Message ---Source: w3m Source-Version: 0.5.3-28 We believe that the bug you reported is fixed in the latest version of w3m, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Tatsuya Kinoshita <[email protected]> (supplier of updated w3m package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Mon, 23 May 2016 21:23:41 +0900 Source: w3m Binary: w3m w3m-img Architecture: source amd64 Version: 0.5.3-28 Distribution: unstable Urgency: medium Maintainer: Tatsuya Kinoshita <[email protected]> Changed-By: Tatsuya Kinoshita <[email protected]> Description: w3m - WWW browsable pager with excellent tables/frames support w3m-img - inline image extension support utilities for w3m Closes: 820162 820373 820902 Changes: w3m (0.5.3-28) unstable; urgency=medium . * Update 020_debian.patch to v0.5.3+git20160511 - Fix crash with crafted html files (closes: #820162, #820373) - Cleanup obsolete INIT_MAILCAP (closes: #820902) * Add extbrowser2..9 configurations * Supplement config parameters * Add firefox | www-browser, wget | curl, xsel, mpv to Suggests * Depend on libgpm-dev instead of libgpmg1-dev * Update Standards-Version to 3.9.8 Checksums-Sha1: e3f80f91bd3d98698ceeae29b76630102b51d86e 2026 w3m_0.5.3-28.dsc f4aa6b5baa4a6578a9ab517311e48fe4d152dbe0 155304 w3m_0.5.3-28.debian.tar.xz fe938809fcfe0fe5b72e6802f2c86c62abbb3221 894474 w3m-dbgsym_0.5.3-28_amd64.deb 8367a3fffdf46b1806711d6ab17b10321cf12def 26200 w3m-img-dbgsym_0.5.3-28_amd64.deb 080da41b72c31270aad20a18a213108a824be08e 126420 w3m-img_0.5.3-28_amd64.deb 35d267ec8b908a69127fd662896a5a3482a2135b 1013254 w3m_0.5.3-28_amd64.deb Checksums-Sha256: 1e5a07fdcc237167626514ba0c7fdc3ebc6f76abec10b40d517570814448b511 2026 w3m_0.5.3-28.dsc 3ce17af934a1ff384cf77798ba744423eb89b6d346a0cd07d11c0185d883167c 155304 w3m_0.5.3-28.debian.tar.xz 7afa8bba53b0c958983f123d8adae185fb317d88d21c1eddd0845df62914a6a9 894474 w3m-dbgsym_0.5.3-28_amd64.deb 816f8541942243d341c770c51d6658f6432d18f7a2f0e43a87c9c8334c5d2686 26200 w3m-img-dbgsym_0.5.3-28_amd64.deb 8d5d1cfdb6cad208bc881670340e98ecccb85b0967d60e4a72d07e1b003a0397 126420 w3m-img_0.5.3-28_amd64.deb 2cd4530b50ab30a56781e8768be51aab81c3be8d2119a52cdfcb08482541d44f 1013254 w3m_0.5.3-28_amd64.deb Files: fe15428206db17ab9835b43e85ab8134 2026 web optional w3m_0.5.3-28.dsc 6423da3abb142d086e3ef139b7c31d75 155304 web optional w3m_0.5.3-28.debian.tar.xz 66e1a50148388e635dd46d641136c2c7 894474 debug extra w3m-dbgsym_0.5.3-28_amd64.deb 4d85f22c9ad853e74378e185af803b17 26200 debug extra w3m-img-dbgsym_0.5.3-28_amd64.deb b82b483b144999277208f66115119b2e 126420 web optional w3m-img_0.5.3-28_amd64.deb 851ad5208ba154f904c17a2845354d23 1013254 web optional w3m_0.5.3-28_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJXQvpIAAoJEOXvq5AIDqY8Xo8P/3satXRj6+HRjAasVB1AVJw3 wJ8i2pMJZewN6VFq4gYo0pb3kKeqSWZWUKC6UY3cB+zqMKeDLpX2K/G7uuG6wFcD kBuEjOiEq4goA77reWJIDmKfcoznyllYYhlhTbm46yJH3NN8KNRAZMcuFGp+Z3a9 cWj49JoEjUwKjCdgHEGrzNc3vRqeT6CKZ9AVFMKK4kqfB5z/6VoP14fKCStgpliz KmkViuLZgMBNbvnt9TGtMDf9FmahLoOymXBoLVbpnTR2J0M0C4aOa5Sx2I2Iz9sj 9QeQNE32L20mUqN0udC9MpbvUVSFR22QFbxIWrlqkncVp2EmOYNxtsEzoYHToC58 nfmmTGWIIDqF40JHJItCRr4lCshqNF+8ZR3riLemT93F5JO0uDn3NGYOhgPuzPtd 2OnEZjOw85KuaRjbeSC1rAPmcmhQN8t/eH4MI0+0son4GWToLaPXKBBBGS7vEtBE u8PacqxlEdc+PXBPfVz9zv3Sp2tDdzwuCRfiyJFgzZrReeXrkEAqYLLFA2Xa1wbw D+cJG9YZYen+GKX3pip9tkP6MYSLCv9xlgs9ZXu08SjeA+Jl3+DylLoXvJnku3kj 2NBAx4KjEoPHMzLpfUevIYTBzyHLoaPWMGzVDE//qFsHvhj847+JgTUKAJhXaUA+ OAprRPfSXY0r37JMqofm =kW9m -----END PGP SIGNATURE-----
--- End Message ---
