ueno/libskk — Issue #2: Very long output from a server can cause segfault on OpenBSD
Author: tamo
Created: 2011-12-24 11:11:16+00:00
State: open

On OpenBSD -current i386,
with ibus-skk-1.3.99.20111220,
using user.dict and skkserv (without using a system jisyo file),
pressing "Kan " crashes ibus-engine-skk.

Maybe I'm doing something wrong
because I don't see anything broken in your code.

Anyways, here is a typescript:

Script started on Sat Dec 24 19:18:52 2011
~ [0] 19:18$ gdb /usr/local/libexec/ibus-engine-skk ibus-engine-skk.core
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-unknown-openbsd5.0"...(no debugging symbols found)

Core was generated by `ibus-engine-skk'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libpthread.so.13.1...done.
Loaded symbols for /usr/lib/libpthread.so.13.1
Reading symbols from /usr/local/lib/libibus-1.0.so.0.0...done.
Loaded symbols for /usr/local/lib/libibus-1.0.so.0.0
Reading symbols from /usr/local/lib/libskk.so.0.0...done.
Loaded symbols for /usr/local/lib/libskk.so.0.0
Reading symbols from /usr/local/lib/libjson-glib-1.0.so.4.0...done.
Loaded symbols for /usr/local/lib/libjson-glib-1.0.so.4.0
Reading symbols from /usr/lib/libz.so.4.1...done.
Loaded symbols for /usr/lib/libz.so.4.1
Reading symbols from /usr/local/lib/libgio-2.0.so.2992.0...done.
Loaded symbols for /usr/local/lib/libgio-2.0.so.2992.0
Reading symbols from /usr/local/lib/libgmodule-2.0.so.2992.0...done.
Loaded symbols for /usr/local/lib/libgmodule-2.0.so.2992.0
Reading symbols from /usr/local/lib/libgee.so.1.0...done.
Loaded symbols for /usr/local/lib/libgee.so.1.0
Reading symbols from /usr/local/lib/libffi.so.0.0...done.
Loaded symbols for /usr/local/lib/libffi.so.0.0
Reading symbols from /usr/local/lib/libpcre.so.2.5...done.
Loaded symbols for /usr/local/lib/libpcre.so.2.5
Reading symbols from /usr/local/lib/libgobject-2.0.so.2992.0...done.
Loaded symbols for /usr/local/lib/libgobject-2.0.so.2992.0
Reading symbols from /usr/local/lib/libgthread-2.0.so.2992.0...done.
Loaded symbols for /usr/local/lib/libgthread-2.0.so.2992.0
Reading symbols from /usr/local/lib/libglib-2.0.so.2992.0...done.
Loaded symbols for /usr/local/lib/libglib-2.0.so.2992.0
Reading symbols from /usr/local/lib/libintl.so.5.0...done.
Loaded symbols for /usr/local/lib/libintl.so.5.0
Reading symbols from /usr/local/lib/libiconv.so.6.0...done.
Loaded symbols for /usr/local/lib/libiconv.so.6.0
Symbols already loaded for /usr/lib/libpthread.so.13.1
Reading symbols from /usr/lib/libc.so.61.0...done.
Loaded symbols for /usr/lib/libc.so.61.0
Reading symbols from /usr/libexec/ld.so...done.
Loaded symbols for /usr/libexec/ld.so
Reading symbols from /usr/local/lib/gio/modules/libgiofam.so...done.
Loaded symbols for /usr/local/lib/gio/modules/libgiofam.so
Reading symbols from /usr/local/lib/libfam.so.1.0...done.
Loaded symbols for /usr/local/lib/libfam.so.1.0
#0 0x02efbe21 in strlen () from /usr/lib/libc.so.61.0
(gdb) bt
#0 0x02efbe21 in strlen () from /usr/lib/libc.so.61.0
#1 0x01734985 in g_string_insert_len () from /usr/local/lib/libglib-2.0.so.2992.0
#2 0x01734c61 in g_string_append () from /usr/local/lib/libglib-2.0.so.2992.0
#3 0x00d0afb0 in skk_skk_serv_read_response (self=0x80ac1000, error=0xcfbea8ac) at skkserv.c:482
#4 0x00d0b601 in skk_skk_serv_real_lookup (base=0x80ac1000, midasi=0x88b22e80 "?\201\213?\202\223", okuri=0, result_length1=0xcfbea990)
at skkserv.c:683
#5 0x00cffbcc in skk_dict_lookup (self=0x80ac1000, midasi=0x88b22e80 "?\201\213?\202\223", okuri=0, result_length1=0xcfbea990) at dict.c:462
#6 0x00d18abf in skk_state_lookup (self=0x7cd0d070, midasi=0x88b22360 "?\201\213?\202\223", okuri=0) at state.c:1625
#7 0x00d1ff2a in skk_select_state_handler_real_process_key_event (base=0x809b7d40, state=0x7cd0d070, key=0xcfbeac94) at state.c:4925
#8 0x00d1a19a in skk_state_handler_process_key_event (self=0x809b7d40, state=0x7cd0d070, key=0xcfbeac94) at state.c:2138
#9 0x00d2270a in skk_context_process_key_event_internal (self=0x7ebd7938, key=0x8bc0d2a0) at context.c:1316
#10 0x00d2259f in skk_context_process_key_event (self=0x7ebd7938, key=0x8bc0d2a0) at context.c:1268
#11 0x1c00479c in ?? ()
#12 0x7ebd7938 in ?? ()
#13 0x8bc0d2a0 in ?? ()
#14 0x00000000 in ?? ()
(gdb) f 3
#3 0x00d0afb0 in skk_skk_serv_read_response (self=0x80ac1000, error=0xcfbea8ac) at skkserv.c:482
482 g_string_append (_tmp16_, (const gchar*) _tmp17_);
(gdb) list
477 _buffer_length1 = _tmp15__length1;
478 __buffer_size_ = _buffer_length1;
479 _tmp16_ = builder;
480 _tmp17_ = _buffer;
481 _tmp17__length1 = _buffer_length1;
482 g_string_append (_tmp16_, (const gchar*) _tmp17_);
483 _buffer = (g_free (_buffer), NULL);
484 }
485 }
486 }
(gdb) p _tmp15_
$1 = (
guint8 *) 0x86917000 "1/??/??;????/??/??/??/??/??/??/??/??/??;??pipe/??;?鳏工???????/??/??/??/??/??;??-??/??;??-?司???/??;?乜?/??;?椎?/??;[????]/??/??/??;????/??;????/??;????/??;????/??;????/??;????/??/??;?站?/??;?执铡驻伟"...
(gdb) p _tmp15__length1
$2 = 1971
(gdb) p _tmp16_
$3 = (GString *) 0x88f77ba0
(gdb) p *_tmp16_
$4 = {str = 0x88b22000 "", len = 0, allocated_len = 4}
(gdb) p _tmp17_
$5 = (
guint8 *) 0x86917000 "1/??/??;????/??/??/??/??/??/??/??/??/??;??pipe/??;?鳏工???????/??/??/??/??/??;??-??/??;??-?司???/??;?乜?/??;?椎?/??;[????]/??/??/??;????/??;????/??;????/??;????/??;????/??;????/??/??;?站?/??;?执铡驻伟"...
(gdb) p _tmp17__length1
$6 = 1971
(gdb) quit
~ [0] 19:22$ exit
~ [0] 19:22$ ldd /usr/local/libexec/ibus-engine-skk
/usr/local/libexec/ibus-engine-skk:
Start End Type Open Ref GrpRef Name
1c000000 3c004000 exe 1 0 0 /usr/local/libexec/ibus-engine-skk
0ee46000 2ee5c000 rlib 0 1 0 /usr/local/lib/libibus-1.0.so.0.0
0a25c000 2a267000 rlib 0 1 0 /usr/local/lib/libskk.so.0.0
0f8a5000 2f8ac000 rlib 0 2 0 /usr/local/lib/libjson-glib-1.0.so.4.0
02540000 22547000 rlib 0 5 0 /usr/lib/libz.so.4.1
04514000 24541000 rlib 0 4 0 /usr/local/lib/libgio-2.0.so.2992.0
0f0a0000 2f0a4000 rlib 0 5 0 /usr/local/lib/libgmodule-2.0.so.2992.0
075fc000 27607000 rlib 0 2 0 /usr/local/lib/libgee.so.1.0
01f2e000 21f32000 rlib 0 7 0 /usr/local/lib/libffi.so.0.0
06f71000 26f85000 rlib 0 10 0 /usr/local/lib/libpcre.so.2.5
094e3000 294ef000 rlib 0 6 0 /usr/local/lib/libgobject-2.0.so.2992.0
0a896000 2a89a000 rlib 0 7 0 /usr/local/lib/libgthread-2.0.so.2992.0
0977b000 297cd000 rlib 0 9 0 /usr/local/lib/libglib-2.0.so.2992.0
02c52000 22c56000 rlib 0 10 0 /usr/local/lib/libintl.so.5.0
0598c000 25a6c000 rlib 0 10 0 /usr/local/lib/libiconv.so.6.0
0740e000 27417000 rlib 0 1 0 /usr/lib/libpthread.so.13.1
00f98000 20fc6000 rlib 0 1 0 /usr/lib/libc.so.61.0
0bb03000 0bb03000 rtld 0 1 0 /usr/libexec/ld.so
~ [0] 19:22$ exit

Script done on Sat Dec 24 19:22:43 2011