https://bugs.kde.org/show_bug.cgi?id=524271
--- Comment #4 from Nicolas Pomarede <[email protected]> --- Hi since posting this comment, I made more research and looked at the Konsole's code based on the trace I got at the time of the crash. I think the Fedora bug was closed by mistake and that it's really a bug If you look at the backtrace and at these lines : #15 0x00007ffb61e5920c in Konsole::Screen::writeToStream (this=this@entry=0x55cc1114aeb0, decoder=decoder@entry=0x7fff730b4ef0, startIndex=startIndex@entry=107, endIndex=endIndex@entry=7103, options=options@entry=...) at /usr/src/debug/konsole-26.04.2-1.fc44.x86_64/src/Screen.cpp:2050 start = <optimized out> count = -43 appendNewLine = true copied = <optimized out> y = 0 top = 0 left = <optimized out> bottom = 40 right = <optimized out> you can see that's count is set to -43. so, in the above BR we can see that count is set to -43 when calling Screen::copyLineToStream, this is certainly not right as the code in copyLineToStream only expects -1 as a special negative case else count seems to be expected to be >0 looking further, I found this patch https://github.com/KDE/konsole/commit/fdfc223fb87c96816fba996c2fe900ff463d94f9 that's the one referenced in https://bugs.kde.org/show_bug.cgi?id=519276 but unfortunately the author of the patch says it was not backported to konsole 26.04, only to the upcoming 26.08 as it is, the code to compute "count" in Screen::writeToStream in konsole 26.04 doesn't look ok to me, we can see that it can lead to negative value, it doesn't check that it subtracts the smallest value from the biggest value. I asked on Mageia devel mailing list if the above patch can be backported to Mageia devel, and I will test if this fixes the issue In the meantime I was also able to reproduce the crash (it's easier once you find the possibly offending code). The "trick" seems to create a rectangular selection going from right to left (and not left to right) to obtain a negative value of "count" - in konsole, type a command that outputs lot of text (for example "ll" in a directory with many files) repeat : - then press ctrl+alt + left mouse button to start a rectangular selection in the on-screen text - try to create a selection from the bottom right corner somewhere in the text and move left+up to the desired upper left corner. 10 lines and 40 colums are enough for me to crash - press "enter" key several times to advance in the history. This should crash. If no crash, repeat with a new rectangular selection. what matters is to create a selection from right to left to trigger a negative value of "count" With this I was able to crash konsole several times in a row. -- You are receiving this mail because: You are watching all bug changes.
