midori segfaults when click upper address input

[Allen Lowe]

when i click right part of address input ,
midori segfaults. on midori 0.2.8-15-g1a404c5 with GTK+ 2.14.4, WebKitGTK+ 1.3.4

look at this screenshot

http://img820.imageshack.us/img820/9589/screenshot076z.png

[/media/sdc1/bin-chromium]$ gdb midori
GNU gdb (GDB) 7.0.50.20091130-cvs
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/midori...done.
(gdb) r
Starting program: /usr/bin/midori
[Thread debugging using libthread_db enabled]
[New Thread 0xb4b75b90 (LWP 27062)]
[New Thread 0xb3f24b90 (LWP 27063)]
[New Thread 0xb3723b90 (LWP 27064)]
[Thread 0xb3723b90 (LWP 27064) exited]
[New Thread 0xb3723b90 (LWP 27068)]
** Message: NP_Initialize
** Message: NP_Initialize succeeded
NPP_Initialize()
** Message: NP_Initialize
** Message: NP_Initialize succeeded
djview: QDjViewPlugin::exec() begin
** Message: NP_Initialize
** Message: NP_Initialize succeeded
** Message: NP_Initialize
** Message: NP_Initialize succeeded

Program received signal SIGSEGV, Segmentation fault.
append_escaped_text (text=0x9e6e000 <Address 0x9e6e000 out of bounds>, length=-1) at gmarkup.c:2040
2040 next = g_utf8_next_char (p);
(gdb) bt full
#0 append_escaped_text (text=0x9e6e000 <Address 0x9e6e000 out of bounds>, length=-1) at gmarkup.c:2040
end = 0x9db4a73 ""
c = <value optimised out>
#1 IA__g_markup_escape_text (text=0x9e6e000 <Address 0x9e6e000 out of bounds>, length=-1) at gmarkup.c:2117
str = 0x9dc3a90
__PRETTY_FUNCTION__ = "IA__g_markup_escape_text"
#2 0x08093aeb in midori_location_entry_render_text_cb (layout=0x9cf8480, renderer=0x9b350a0, model=0x9c17618, iter=0xbfffcfc4,
data=0x9bd7058) at ../midori/midori-locationaction.c:1163
action = 0x9bd7058
uri_escaped = 0x9de75e0 "http://bsearch.goo.ne.jp/image.php?cc=1&mt=\244\267\244ۤ\316\316", <incomplete sequence \303>
uri = 0x9db4a40 "http://bsearch.goo.ne.jp/image.php?CC=1&MT=\244\267\244ۤ\316\316", <incomplete sequence \303>
title = 0x9ddd5c0 "‪[しほの涼] 画像検索結果 - goo画像・動画・音楽検索"
style = 0
desc = 0x0
desc_uri = 0x0
desc_iter = 0x9db4a40 "http://bsearch.goo.ne.jp/image.php?CC=1&MT=\244\267\244ۤ\316\316", <incomplete sequence \303>
temp_iter = 0x9de75e0 "http://bsearch.goo.ne.jp/image.php?cc=1&mt=\244\267\244ۤ\316\316", <incomplete sequence \303>
desc_title = 0x0
str = 0x80c3b1a ""
key = 0x0
keys = 0x9d7af38
key_idx = 0
start = 0xb77e8431 "\203\304,[^_]Í\264&"
skey = 0xbfffcdf8 "(\316\377\277H\020Ʒ\200\204\317\t\240P\263\t\030v\301\t\304\317\377\277Xp\275\t\250P\263\t\240P\263\t\364\037", <incomplete sequence \366\267>
temp = 0x9de75e0 "http://bsearch.goo.ne.jp/image.php?cc=1&mt=\244\267\244ۤ\316\316", <incomplete sequence \303>
temp_concat = 0xb7677440 "U\272\001"
temp_markup = 0xb788aff4 "\270\256\f"
parts = 0x69b2
offset = 0
#3 0xb7c61048 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
No symbol table info available.
---Type <return> to continue, or q <return> to quit---
#4 0x09cf8480 in ?? ()
No symbol table info available.
#5 0x09b350a0 in ?? ()
No symbol table info available.
#6 0x09c17618 in ?? ()
No symbol table info available.
#7 0xbfffcfc4 in ?? ()
No symbol table info available.
#8 0x09bd7058 in ?? ()
No symbol table info available.
#9 0x09b350a8 in ?? ()
No symbol table info available.
#10 0x09b350a0 in ?? ()
No symbol table info available.
#11 0xb7f61ff4 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
No symbol table info available.
#12 0x00000000 in ?? ()
No symbol table info available.
(gdb) i r
eax 0x9dc3a90 165427856
ecx 0x9dc3a90 165427856
edx 0x10b978 1096056
ebx 0xb788aff4 -1215778828
esp 0xbfffcd30 0xbfffcd30
ebp 0xbfffcd68 0xbfffcd68
esi 0x9e6e000 166125568
edi 0x9e6e000 166125568
eip 0xb78027e8 0xb78027e8 <IA__g_markup_escape_text+120>
eflags 0x10283 [ CF SF IF RF ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
(gdb) q
A debugging session is active.

Inferior 1 [process 27058] will be killed.

Quit anyway? (y or n) y
djview: QDjViewPlugin::exec() end code=0

[Allen Lowe (lallenlowe)]

Comment by Stéphane Marguet (Stemp) - Monday, 29 November 2010, 13:42 GMT+1
I can confirm a similar bug when typing in the location bar.

Midori cannot acces http://www.meteofrance.com/ and is transfered to http://token.meteofrance.com/?u=http%3A%2F%2Fwww.meteofrance.com%2F&s=sim-portail&x=%291%3E%FBm%EF%A9%DE with Forbidden «You don't have permission to access / on this server.» message.

Then if I'm trying to write me on the bar, midori is crashing :

(midori:32595): Gtk-WARNING **: Failed to set text from markup due to error parsing markup: Error on line 2 char 125: Invalid UTF-8 encoded text in name - not valid 'teofrance.com/?u=http://www.meteofrance.com/&s=sim-portail&x=)1>\xfbm\xef\xa9\xde'
Erreur de segmentation

[Allen Lowe (lallenlowe)]

Comment by Patrick Nicolas (xytovl) - Wednesday, 01 December 2010, 22:11 GMT+1
I have exactly the same error, and I can confirm the segmentation fault comes from the history db:
if I do a select * from history where uri like '%meteo%'; I get many results among which
http://token.meteofrance.com/?u=http%3A%2F%2Ffrance.meteofrance.com%2Ffrance%2Fmeteo%3FPREVISIONS_PORTLET.path%3Dprevisionsville%2F060040&s=sim-portail&x=k%FB%C5%F7b%EF%A9%DE|‪403 Forbidden|1291098727|734106
http://www.google.com/search?q=meteo%20antibes|‪meteo antibes - Google Search|1291098740|734106

After a delete from history where uri like '%meteo%'; there is no segmentation fault anymore. If you want the original history.db for testing, I can send it.

PS: midori is version 0.2.9 on Gentoo amd64, gtk+ 2.20.1 and webkit-gtk 1.2.3

[aquanaut (thecrux)]

I think https://bugs.launchpad.net/midori/+bug/700068 is a duplicate of this bug

1. Try to open url mentioned in 700068 (url is saved in history)
2. Than open new tab and type word: search
when typing browser crashed

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5bb78e0 in append_escaped_text (text=<value optimized out>, length=<value optimized out>) at gmarkup.c:2044
2044 next = g_utf8_next_char (p);
(gdb) bt full
#0 0x00007ffff5bb88e0 in append_escaped_text (text=<value optimized out>, length=<value optimized out>) at gmarkup.c:2044
        next = <value optimized out>
        p = 0x3034000 <Address 0x3034000 out of bounds>
        end = 0x1eeee2e ""
        c = <value optimized out>
#1 g_markup_escape_text (text=<value optimized out>, length=<value optimized out>) at gmarkup.c:2120
        str = 0x23dd2a0
        __PRETTY_FUNCTION__ = "g_markup_escape_text"
#2 0x000000000044f480 in midori_location_entry_render_text_cb (layout=0x1f14bc0, renderer=0x1a2aee0, model=0x17eea10,
    iter=0x7fffffffbf00, data=0x15d9030) at ../midori/midori-locationaction.c:1160
        action = 0x15d9030
        uri_escaped = 0x1df8c00 "p\260\310\001"
        uri = 0x1eeede0 "http://search.tut.by/?status=1&encoding=1&page=0&how=rlv&query=\312\355\350\346\355\340\377+\377\360\354\356\360\352", <incomplete sequence \340>
        title = 0x284ad00 "‪TUT.BY | ПОИСК - Байнет - Книжная ярморка"
        style = 0
        desc = 0x0
        desc_uri = 0x1b2cd60 "http://<b>sear</b>"
        desc_iter = 0x1eeedeb "ch.tut.by/?status=1&encoding=1&page=0&how=rlv&query=\312\355\350\346\355\340\377+\377\360\354\356\360\352", <incomplete sequence \340>
        temp_iter = 0x26a9f0b "ch.tut.by/?status=1&encoding=1&page=0&how=rlv&query=\312\355\350\346\355\340\377+\377\360\354\356\360\352", <incomplete sequence \340>
        desc_title = 0x0
        str = 0x26c6a90 "sear"
        key = 0x0
        keys = 0x1cd64a0
        key_idx = 1
        start = 0x26a9f07 "search.tut.by/?status=1&encoding=1&page=0&how=rlv&query=\312\355\350\346\355\340\377+\377\360\354\356\360\352", <incomplete sequence \340>
        skey = 0x1b79f80 ""
        temp = 0x26a9f00 "http://search.tut.by/?status=1&encoding=1&page=0&how=rlv&query=\312\355\350\346\355\340\377+\377\360\354\356\360\352", <incomplete sequence \340>
        temp_concat = 0x7ffff73b3134 "\353+H\213E\350H\213@H\213U\314Hc\322H\301\342\003H\001\320H\213\bH\213U\300H\213E\360H\211\316H\211\307\350,\370\022"
        temp_markup = 0x7fffffffbd80 ""
        parts = 0x1f5a3f0
        offset = 11
#3 0x00007ffff7529fc7 in gtk_tree_view_column_cell_set_cell_data () from /usr/lib64/libgtk-x11-2.0.so.0
No symbol table info available.

After clearing of history ( delete from history where uri like '%search.tut.by%'; ) no crashes.

[Arnaud Renevier (arenevier)]

I can reproduce the bug. As far as I undestand, it happens because urls may contain non utf8 characters (encoded). Unfortunately, midori treats them as utf-8, and at some point, it crashes (when calling g_markup_escape_text actually). A fix could for example, store the encoding of a page when storing it's its uri, so it can be converted from that encoding to utf-8.

Here is a quick and dirty fix that does not unescape uri, when unescaped uri is not valid utf-8. It's not ideal (because for non utf-8 charsets, it would not unescape, or it could even escape in a wrong way), but it least, it prevents midori from crashing.

[Eivind Eide (mokkurkalve)]

This seems to be the same bug that I reported on flyspray that was moved to Bug #706812
For the longest time I haven't used midori as it crashes within the first minute every time due to this.
However (though only briefly tested yet) applying the above "quick and dirty patch" seems to fix this for me.

[Eivind Eide (mokkurkalve)]

Upps! That was declared a bit quick. Going to the uri below, then putting the cursor at the end of the uri in the address field and hit backspace key repeatedly, removing the uri char by char will (still) crash midori before the address field is blank....
http://www.aperitif.no/index.db2?id=11106

[Eivind Eide (mokkurkalve)]

With the "Slightly better solution" patch I can't seem to crash Midori as described in my previous post anymore. So far it seems like a working fix.

[Cris Dywan (kalikiana)]

The patch looks sensible, and while I was never able to reproduce it doesn't cause any harm. Thanks a lot!