Bug#454768: liferea: crashes with SIGFPE

[Dave Beckett]

Nico Golde wrote:
> Hi Gabor,
> * Gabor Gombas <[EMAIL PROTECTED]> [2007-12-11 15:02]:
>> On Tue, Dec 11, 2007 at 02:46:59PM +0100, Nico Golde wrote:
>>
>>> I did not forget it, it was attached by the one who replied 
>>> to this bug before me :)
>> Hmm, that mail did not reach me for some reason. Anyways, I've extracted
>> the patch from the BTS and I can confirm that if fixes the problem on
>> i386. Will check amd64 in the evening.
> 
> Thank you. I again contacted the upstream author because I 
> definetely miss the insight about the libcairo code base to 
> see what is causing this.
> 
> Dave, are you available to do the next upload?
> 
> The best would be to upload the new upstream version.

I've packaged 1.4.12 but it's in the NEW queue, ETA 1 week by
the look of it.

Dave



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#454768: liferea: crashes with SIGFPE

[Nico Golde]

Hi Gabor,
* Gabor Gombas <[EMAIL PROTECTED]> [2007-12-11 15:02]:
> On Tue, Dec 11, 2007 at 02:46:59PM +0100, Nico Golde wrote:
> 
> > I did not forget it, it was attached by the one who replied 
> > to this bug before me :)
> 
> Hmm, that mail did not reach me for some reason. Anyways, I've extracted
> the patch from the BTS and I can confirm that if fixes the problem on
> i386. Will check amd64 in the evening.

Thank you. I again contacted the upstream author because I 
definetely miss the insight about the libcairo code base to 
see what is causing this.

Dave, are you available to do the next upload?

The best would be to upload the new upstream version.

Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.


pgp6fJ69EQ0vL.pgp
Description: PGP signature

Bug#454768: liferea: crashes with SIGFPE

[Gabor Gombas]

On Tue, Dec 11, 2007 at 02:46:59PM +0100, Nico Golde wrote:

> I did not forget it, it was attached by the one who replied 
> to this bug before me :)

Hmm, that mail did not reach me for some reason. Anyways, I've extracted
the patch from the BTS and I can confirm that if fixes the problem on
i386. Will check amd64 in the evening.

Gabor

-- 
 -
 MTA SZTAKI Computer and Automation Research Institute
Hungarian Academy of Sciences
 -



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#454768: liferea: crashes with SIGFPE

[Gabor Gombas]

On Tue, Dec 11, 2007 at 07:38:43AM +0100, Nico Golde wrote:

> Since I can not reproduce the failure, Gabor can you test 
> this patch?

It seems you forgot the patch... Btw, I've just tested on a different
machine, this time i386 (updated to sid as the time of this mail) but
basically the same configuration, and it shows the same problem.

Gabor

-- 
 -
 MTA SZTAKI Computer and Automation Research Institute
Hungarian Academy of Sciences
 -



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#454768: liferea: crashes with SIGFPE

[Nico Golde]

Hi Gabor,
* Gabor Gombas <[EMAIL PROTECTED]> [2007-12-11 14:44]:
> On Tue, Dec 11, 2007 at 07:38:43AM +0100, Nico Golde wrote:
> 
> > Since I can not reproduce the failure, Gabor can you test 
> > this patch?
> 
> It seems you forgot the patch... Btw, I've just tested on a different
> machine, this time i386 (updated to sid as the time of this mail) but
> basically the same configuration, and it shows the same problem.

I did not forget it, it was attached by the one who replied 
to this bug before me :)
Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.


pgpSMankOo7Vk.pgp
Description: PGP signature

Bug#454768: liferea: crashes with SIGFPE

[Nico Golde]

Hi,
* Takayuki KUSANO <[EMAIL PROTECTED]> [2007-12-11 07:14]:
> I'm running iceweasel on sid for amd64 and met same problem.
>  iceweasel: 2.0.0.11-1
>  libcairo2: 1.4.10-1.2
> With thease versions, iceweasel can not render some pages correctly.
> Most of text are dissapeared.
> 
> When I used iceweasel (2.0.0.11-1) with libcairo2 1.4.10-1.1,
> iceweasel got crashed in _get_bitmap_surface() in libcairo's
> src/cairo-ft-font.c
> (I made libcairo2-dbg to debug on my machine).
> 
> So I backported a change in cairo-ft-font.c from
> new upstream of cairo (1.4.12), and iceweasel works correctly
> (no crash, no text are dissapeared).
> 
> Diff of src/cairo-ft-font.c 1.4.10-1.2 and my own version
> is attached. I'm not sure this fix is correct, but hope this helps.

Since I can not reproduce the failure, Gabor can you test 
this patch?
Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.


pgpDjgCrbnpim.pgp
Description: PGP signature

Bug#454768: liferea: crashes with SIGFPE

[Takayuki KUSANO]

I'm running iceweasel on sid for amd64 and met same problem.
 iceweasel: 2.0.0.11-1
 libcairo2: 1.4.10-1.2
With thease versions, iceweasel can not render some pages correctly.
Most of text are dissapeared.

When I used iceweasel (2.0.0.11-1) with libcairo2 1.4.10-1.1,
iceweasel got crashed in _get_bitmap_surface() in libcairo's
src/cairo-ft-font.c
(I made libcairo2-dbg to debug on my machine).

So I backported a change in cairo-ft-font.c from
new upstream of cairo (1.4.12), and iceweasel works correctly
(no crash, no text are dissapeared).

Diff of src/cairo-ft-font.c 1.4.10-1.2 and my own version
is attached. I'm not sure this fix is correct, but hope this helps.

---
  KUSANO Takayuki 



--- libcairo-1.4.10-1.2/src/cairo-ft-font.c	2007-12-11 10:18:41.0 +0900
+++ libcairo-1.4.10-1.2+patch/src/cairo-ft-font.c	2007-12-11 10:07:28.062095832 +0900
@@ -735,6 +735,12 @@
 width = bitmap->width;
 height = bitmap->rows;
 
+if (width == 0 || height == 0) {
+	*surface = (cairo_image_surface_t *)
+	cairo_image_surface_create_for_data (NULL, format, 0, 0, 0);
+	return (*surface)->base.status;
+}
+
 switch (bitmap->pixel_mode) {
 case FT_PIXEL_MODE_MONO:
 	stride = (((width + 31) & ~31) >> 3);

Bug#454768: liferea: crashes with SIGFPE

[Gabor Gombas]

On Mon, Dec 10, 2007 at 05:37:32PM +0100, Nico Golde wrote:

> [...] 
> I doubt this is really caused by the patch fixing the 
> security issue as cairo does nothing else compared without 
> the patch apart from checking what is passed to the memory 
> function. Did you check this is fixed if you downgrade 
> libcairo to the version before the fix?

Yes, verified: after

apt-get install libcairo2=1.4.10-1+b2 libcairo2-dev=1.4.10-1+b2

(ie. the version from lenny) both iceweasel and liferea shows "The
Register" correctly. Upgrading to libcairo2 1.4.10-1.2 makes the text
disappear again in both liferea and iceweasel.

> This is especially 
> curious because I can not reproduce this with
> iceweasel 2.0.0.11-1 and libcairo2 1.4.10-1.2 on 
> http://www.theregister.co.uk/2007/12/10/storage_and_servers_2007_in_review/

Which arcitecture did you test? I'm running amd64.

ii  iceweasel  2.0.0.11-1
ii  liferea1.4.9-1

Gabor

-- 
 -
 MTA SZTAKI Computer and Automation Research Institute
Hungarian Academy of Sciences
 -



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#454768: liferea: crashes with SIGFPE

[Nico Golde]

Hi Gabor,
* Gabor Gombas <[EMAIL PROTECTED]> [2007-12-10 18:05]:
> On Mon, Dec 10, 2007 at 05:37:32PM +0100, Nico Golde wrote:
> 
> > [...] 
> > I doubt this is really caused by the patch fixing the 
> > security issue as cairo does nothing else compared without 
> > the patch apart from checking what is passed to the memory 
> > function. Did you check this is fixed if you downgrade 
> > libcairo to the version before the fix?
> 
> Yes, verified: after
> 
>   apt-get install libcairo2=1.4.10-1+b2 libcairo2-dev=1.4.10-1+b2
> 
> (ie. the version from lenny) both iceweasel and liferea shows "The
> Register" correctly. Upgrading to libcairo2 1.4.10-1.2 makes the text
> disappear again in both liferea and iceweasel.

Ok, strange I don't see the reason.

> > This is especially 
> > curious because I can not reproduce this with
> > iceweasel 2.0.0.11-1 and libcairo2 1.4.10-1.2 on 
> > http://www.theregister.co.uk/2007/12/10/storage_and_servers_2007_in_review/
> 
> Which arcitecture did you test? I'm running amd64.

i386
Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.


pgpp6TX1mJLxf.pgp
Description: PGP signature

Bug#454768: liferea: crashes with SIGFPE

[Nico Golde]

Hi Gabor,
* Gabor Gombas <[EMAIL PROTECTED]> [2007-12-10 13:33]:
[...] 
> Well, after the latest libcairo update liferea and iceweasel do no
> longer crash, but the bug fix does not seem to be complete as now there
> is a new symptom: opening http://www.theregister.co.uk in iceweasel or
> opening any article in liferea (sample URL:
> http://www.theregister.co.uk/2007/12/10/storage_and_servers_2007_in_review/)
> show pages with most of the text missing.
[...] 
I doubt this is really caused by the patch fixing the 
security issue as cairo does nothing else compared without 
the patch apart from checking what is passed to the memory 
function. Did you check this is fixed if you downgrade 
libcairo to the version before the fix? This is especially 
curious because I can not reproduce this with
iceweasel 2.0.0.11-1 and libcairo2 1.4.10-1.2 on 
http://www.theregister.co.uk/2007/12/10/storage_and_servers_2007_in_review/

Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.


pgpnMo0pJSJ01.pgp
Description: PGP signature

Bug#454768: liferea: crashes with SIGFPE

[Gabor Gombas]

reopen 454768
retitle 454768 Invisible text in liferea & iceweasel
thanks

On Fri, Dec 07, 2007 at 08:07:34PM +0100, Nico Golde wrote:

> Thank you for the report, I reassigned your bug to libcairo 
> as it seems to be the same problem as described in #454702.
> I mailed the cairo guys if they see the reason. Ubuntu 
> currently has the same patch without crashes and different 
> people looking at the patch also didn't see a problem. I 
> hope this gets fixed soon.

Well, after the latest libcairo update liferea and iceweasel do no
longer crash, but the bug fix does not seem to be complete as now there
is a new symptom: opening http://www.theregister.co.uk in iceweasel or
opening any article in liferea (sample URL:
http://www.theregister.co.uk/2007/12/10/storage_and_servers_2007_in_review/)
show pages with most of the text missing.

If I select the empty area where the article's text should be with the
mouse and cut & paste it into a terminal window, the text appears there.
But in iceweasel and liferea, the text is invisible.

Btw. not all the text is invisible, some keywords in the atricle's
categorization still show up. Screenshots are available at
http://boogie.lpds.sztaki.hu/~gombasg/bug/liferea.png and
http://boogie.lpds.sztaki.hu/~gombasg/bug/iceweasel.png .

Gabor

-- 
 -
 MTA SZTAKI Computer and Automation Research Institute
Hungarian Academy of Sciences
 -



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#454768: liferea: crashes with SIGFPE

[Luis Rodrigo Gallardo Cruz]

On Fri, Dec 07, 2007 at 08:07:34PM +0100, Nico Golde wrote:
> Hi,
> * Gábor Gombás <[EMAIL PROTECTED]> [2007-12-07 19:50]:
> > Recently liferea started to crash with SIGFPE.
> Thank you for the report, I reassigned your bug to libcairo 

Neat! No work for me ;)

> as it seems to be the same problem as described in #454702.
> I mailed the cairo guys if they see the reason. 

For the record, I'm using 1.4.10-1 and I'm not seeing the problem.

-- 
Rodrigo Gallardo
GPG-Fingerprint: 7C81 E60C 442E 8FBC D975  2F49 0199 8318 ADC9 BC28


signature.asc
Description: Digital signature

Bug#454768: liferea: crashes with SIGFPE

[Luis Rodrigo Gallardo Cruz]

On Fri, Dec 07, 2007 at 07:26:27PM +0100, Gábor Gombás wrote:
> Recently liferea started to crash with SIGFPE. For example, trying to
> open any article from "The Register" results in a crash.

Could you give me a specific URL? I just subscribed to the feed for
software (http://www.theregister.co.uk/software/headlines.atom), read
the first article there (http://www.theregister.co.uk/2007/12/07/ie8_moniker/)
and opened it in another tab with no problem.

> Telling liferea
> to open articles in an external browser and trying the same article also
> crashes iceweasel, but not epiphany.

Given this and the fact that 'it works for me' I suspect the problem
to be in different library versions. I'll check in a little while
which are different in your install from mine.

-- 
Rodrigo Gallardo
GPG-Fingerprint: 7C81 E60C 442E 8FBC D975  2F49 0199 8318 ADC9 BC28


signature.asc
Description: Digital signature

Bug#454768: liferea: crashes with SIGFPE

[Nico Golde]

Hi,
* Gábor Gombás <[EMAIL PROTECTED]> [2007-12-07 19:50]:
> Recently liferea started to crash with SIGFPE. For example, trying to
> open any article from "The Register" results in a crash. Telling liferea
> to open articles in an external browser and trying the same article also
> crashes iceweasel, but not epiphany. Here's a trace from gdb (I know having
> libgtk2.0-dbg and libxul0d-dbg would have been useful, but those are too
> big to download over a GPRS modem):

Thank you for the report, I reassigned your bug to libcairo 
as it seems to be the same problem as described in #454702.
I mailed the cairo guys if they see the reason. Ubuntu 
currently has the same patch without crashes and different 
people looking at the patch also didn't see a problem. I 
hope this gets fixed soon.
Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.


pgp8l7Gaswvd9.pgp
Description: PGP signature

Bug#454768: liferea: crashes with SIGFPE

[Gábor Gombás]

Package: liferea
Version: 1.4.9-1
Severity: important


Hi,

Recently liferea started to crash with SIGFPE. For example, trying to
open any article from "The Register" results in a crash. Telling liferea
to open articles in an external browser and trying the same article also
crashes iceweasel, but not epiphany. Here's a trace from gdb (I know having
libgtk2.0-dbg and libxul0d-dbg would have been useful, but those are too
big to download over a GPRS modem):

Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread 0x2b9efc3841e0 (LWP 26929)]
0x003e0202707c in ?? () from /usr/lib/libcairo.so.2
(gdb) bt
#0  0x003e0202707c in ?? () from /usr/lib/libcairo.so.2
#1  0x003e02028cdf in ?? () from /usr/lib/libcairo.so.2
#2  0x003e02019993 in ?? () from /usr/lib/libcairo.so.2
#3  0x003e0203f8ed in ?? () from /usr/lib/libcairo.so.2
#4  0x003e0201d512 in ?? () from /usr/lib/libcairo.so.2
#5  0x003e0200fe81 in ?? () from /usr/lib/libcairo.so.2
#6  0x003e02009b2c in cairo_show_glyphs () from /usr/lib/libcairo.so.2
#7  0x003e012071b6 in pango_cairo_renderer_draw_glyphs (renderer=, 
font=, glyphs=, x=, 
y=) at 
/tmp/buildd/pango1.0-1.18.3/pango/pangocairo-render.c:261
#8  0x00317742656e in pango_renderer_draw_glyphs (renderer=, 
font=, glyphs=, x=, 
y=) at 
/tmp/buildd/pango1.0-1.18.3/pango/pango-renderer.c:626
#9  0x003e012066a8 in _pango_cairo_do_glyph_string (cr=, 
font=, glyphs=, do_path=)
at /tmp/buildd/pango1.0-1.18.3/pango/pangocairo-render.c:525
#10 0x00317742656e in pango_renderer_draw_glyphs (renderer=, 
font=, glyphs=, x=, 
y=) at 
/tmp/buildd/pango1.0-1.18.3/pango/pango-renderer.c:626
#11 0x003177426ac2 in pango_renderer_draw_layout_line (renderer=, 
line=, x=, y=)
at /tmp/buildd/pango1.0-1.18.3/pango/pango-renderer.c:557
#12 0x003e01c26175 in gdk_draw_layout_line_with_colors () from 
/usr/lib/libgdk-x11-2.0.so.0
#13 0x003e01c26342 in gdk_draw_layout_line () from 
/usr/lib/libgdk-x11-2.0.so.0
#14 0x003e054165ff in ?? () from /usr/lib/libxul.so.0d
#15 0x003e0540b812 in ?? () from /usr/lib/libxul.so.0d
#16 0x003e04be5d13 in nsRenderingContextImpl::DrawString () from 
/usr/lib/libxul.so.0d
#17 0x003e04e5c219 in ?? () from /usr/lib/libxul.so.0d
#18 0x003e04e5ce44 in ?? () from /usr/lib/libxul.so.0d
#19 0x003e04e0f274 in ?? () from /usr/lib/libxul.so.0d
#20 0x003e04e0f0e2 in ?? () from /usr/lib/libxul.so.0d
#21 0x003e04e25ec3 in ?? () from /usr/lib/libxul.so.0d
#22 0x003e04e32822 in ?? () from /usr/lib/libxul.so.0d
#23 0x003e04e0f274 in ?? () from /usr/lib/libxul.so.0d
#24 0x003e04e0f0e2 in ?? () from /usr/lib/libxul.so.0d
#25 0x003e04e25ec3 in ?? () from /usr/lib/libxul.so.0d
#26 0x003e04e32822 in ?? () from /usr/lib/libxul.so.0d
#27 0x003e04e0f274 in ?? () from /usr/lib/libxul.so.0d
#28 0x003e04e022ff in ?? () from /usr/lib/libxul.so.0d
#29 0x003e04e25ec3 in ?? () from /usr/lib/libxul.so.0d
#30 0x003e04e02025 in ?? () from /usr/lib/libxul.so.0d
#31 0x003e04e0f274 in ?? () from /usr/lib/libxul.so.0d
---Type  to continue, or q  to quit---
#32 0x003e04e022ff in ?? () from /usr/lib/libxul.so.0d
#33 0x003e04e25ec3 in ?? () from /usr/lib/libxul.so.0d
#34 0x003e04e02025 in ?? () from /usr/lib/libxul.so.0d
#35 0x003e04e0f274 in ?? () from /usr/lib/libxul.so.0d
#36 0x003e04e022ff in ?? () from /usr/lib/libxul.so.0d
#37 0x003e04e25ec3 in ?? () from /usr/lib/libxul.so.0d
#38 0x003e04e02025 in ?? () from /usr/lib/libxul.so.0d
#39 0x003e04e0f274 in ?? () from /usr/lib/libxul.so.0d
#40 0x003e04e0f0e2 in ?? () from /usr/lib/libxul.so.0d
#41 0x003e04e25c3b in ?? () from /usr/lib/libxul.so.0d
#42 0x003e04e2651d in ?? () from /usr/lib/libxul.so.0d
#43 0x003e04dec01f in ?? () from /usr/lib/libxul.so.0d
#44 0x003e05091893 in ?? () from /usr/lib/libxul.so.0d
#45 0x003e05094247 in ?? () from /usr/lib/libxul.so.0d
#46 0x003e0509a0e5 in ?? () from /usr/lib/libxul.so.0d
#47 0x003e0509b0aa in ?? () from /usr/lib/libxul.so.0d
#48 0x003e0509ba0e in ?? () from /usr/lib/libxul.so.0d
#49 0x003e05091570 in ?? () from /usr/lib/libxul.so.0d
#50 0x003e053d68eb in ?? () from /usr/lib/libxul.so.0d
#51 0x003e053cef0a in ?? () from /usr/lib/libxul.so.0d
#52 0x003e053cef90 in ?? () from /usr/lib/libxul.so.0d
#53 0x003e0174ad9f in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#54 0x00317240ca1f in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#55 0x0031724206e8 in ?? () from /usr/lib/libgobject-2.0.so.0
#56 0x003172421e6f in g_signal_emit_valist () from 
/usr/lib/libgobject-2.0.so.0
#57 0x003172422533 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#58 0x003e01851c05 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#59 0x003e01744fb2 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#60 0x003e01c34ba4 in ?? () from /usr/lib/libgdk-x11-2.0.so.0