Buffer overflow in kompozer-bin (crash at startup in jaunty)

[Sascha Morr]

When i start kompozer (from the universe repository) on my ubuntu 9.04 (development branch) test system i get the following output into the terminal:

sascha@workstation:~$ kompozer
*** buffer overflow detected ***: /usr/lib/kompozer/kompozer-bin terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb7445da8]
/lib/tls/i686/cmov/libc.so.6[0xb7443eb0]
/lib/tls/i686/cmov/libc.so.6[0xb7444618]
/usr/lib/kompozer/kompozer-bin[0x804e968]
/usr/lib/kompozer/kompozer-bin[0x804ba43]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb735e775]
/usr/lib/kompozer/kompozer-bin[0x804b971]
======= Memory map: ========
08048000-08057000 r-xp 00000000 08:01 737562 /usr/lib/kompozer/kompozer-bin
08057000-08058000 r--p 0000f000 08:01 737562 /usr/lib/kompozer/kompozer-bin
08058000-08059000 rw-p 00010000 08:01 737562 /usr/lib/kompozer/kompozer-bin
08059000-0805a000 rw-p 08059000 00:00 0
09f04000-09f25000 rw-p 09f04000 00:00 0 [heap]
b7147000-b714a000 rw-p b7147000 00:00 0
b714a000-b714e000 r-xp 00000000 08:01 151225 /usr/lib/libXdmcp.so.6.0.0
b714e000-b714f000 rw-p 00003000 08:01 151225 /usr/lib/libXdmcp.so.6.0.0
b714f000-b7150000 rw-p b714f000 00:00 0
b7150000-b7152000 r-xp 00000000 08:01 151223 /usr/lib/libXau.so.6.0.0
b7152000-b7153000 r--p 00001000 08:01 151223 /usr/lib/libXau.so.6.0.0
b7153000-b7154000 rw-p 00002000 08:01 151223 /usr/lib/libXau.so.6.0.0
b7154000-b7178000 r-xp 00000000 08:01 151286 /usr/lib/libexpat.so.1.5.2
b7178000-b717a000 r--p 00023000 08:01 151286 /usr/lib/libexpat.so.1.5.2
b717a000-b717b000 rw-p 00025000 08:01 151286 /usr/lib/libexpat.so.1.5.2
b717b000-b7193000 r-xp 00000000 08:01 151227 /usr/lib/libxcb.so.1.1.0
b7193000-b7194000 r--p 00017000 08:01 151227 /usr/lib/libxcb.so.1.1.0
b7194000-b7195000 rw-p 00018000 08:01 151227 /usr/lib/libxcb.so.1.1.0
b7195000-b719b000 r-xp 00000000 08:01 151639 /usr/lib/libxcb-render.so.0.0.0
b719b000-b719c000 r--p 00005000 08:01 151639 /usr/lib/libxcb-render.so.0.0.0
b719c000-b719d000 rw-p 00006000 08:01 151639 /usr/lib/libxcb-render.so.0.0.0
b719d000-b71a0000 r-xp 00000000 08:01 151641 /usr/lib/libxcb-render-util.so.0.0.0
b71a0000-b71a1000 r--p 00002000 08:01 151641 /usr/lib/libxcb-render-util.so.0.0.0
b71a1000-b71a2000 rw-p 00003000 08:01 151641 /usr/lib/libxcb-render-util.so.0.0.0
b71a2000-b71a3000 rw-p b71a2000 00:00 0
b71a3000-b71c7000 r-xp 00000000 08:01 151513 /usr/lib/libpng12.so.0.27.0
b71c7000-b71c8000 r--p 00023000 08:01 151513 /usr/lib/libpng12.so.0.27.0
b71c8000-b71c9000 rw-p 00024000 08:01 151513 /usr/lib/libpng12.so.0.27.0
b71c9000-b71dc000 r-xp 00000000 08:01 151631 /usr/lib/libdirect-1.0.so.0.1.0
b71dc000-b71dd000 r--p 00012000 08:01 151631 /usr/lib/libdirect-1.0.so.0.1.0
b71dd000-b71de000 rw-p 00013000 08:01 151631 /usr/lib/libdirect-1.0.so.0.1.0
b71de000-b71e5000 r-xp 00000000 08:01 151633 /usr/lib/libfusion-1.0.so.0.1.0
b71e5000-b71e6000 r--p 00006000 08:01 151633 /usr/lib/libfusion-1.0.so.0.1.0
b71e6000-b71e7000 rw-p 00007000 08:01 151633 /usr/lib/libfusion-1.0.so.0.1.0
b71e7000-b724b000 r-xp 00000000 08:01 151632 /usr/lib/libdirectfb-1.0.so.0.1.0
b724b000-b724c000 r--p 00063000 08:01 151632 /usr/lib/libdirectfb-1.0.so.0.1.0
b724c000-b724d000 rw-p 00064000 08:01 151632 /usr/lib/libdirectfb-1.0.so.0.1.0
b724d000-b728d000 r-xp 00000000 08:01 151423 /usr/lib/libpixman-1.so.0.13.2
b728d000-b728f000 r--p 0003f000 08:01 151423 /usr/lib/libpixman-1.so.0.13.2
b728f000-b7290000 rw-p 00041000 08:01 151423 /usr/lib/libpixman-1.so.0.13.2
b7290000-b7291000 rw-p b7290000 00:00 0
b7291000-b72a9000 r-xp 00000000 08:01 393275 /lib/libselinux.so.1
b72a9000-b72aa000 r--p 00017000 08:01 393275 /lib/libselinux.so.1
b72aa000-b72ab000 rw-p 00018000 08:01 393275 /lib/libselinux.so.1
b72ab000-b72db000 r-xp 00000000 08:01 393288 /lib/libpcre.so.3.12.1
b72db000-b72dc000 r--p 0002f000 08:01 393288 /lib/libpcre.so.3.12.1
b72dc000-b72dd000 rw-p 00030000 08:01 393288 /lib/libpcre.so.3.12.1
b72dd000-b72f1000 r-xp 00000000 08:01 393277 /lib/libz.so.1.2.3.3
b72f1000-b72f2000 r--p 00013000 08:01 39Aborted (core dumped)
sascha@workstation:~$

cheers
Sascha

[js (solard3ity-deactivatedaccount-deactivatedaccount)]

same issue here, got the same error...

[fiat1100d (gratteri-email)]

Got the same problem... When launching from GNOME, got no Kompozer, so from terminal I get this:

*** buffer overflow detected ***: /usr/lib/kompozer/kompozer-bin terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb7448da8]
/lib/tls/i686/cmov/libc.so.6[0xb7446eb0]
/lib/tls/i686/cmov/libc.so.6[0xb7447618]
/usr/lib/kompozer/kompozer-bin[0x804e968]
/usr/lib/kompozer/kompozer-bin[0x804ba43]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb7361775]
/usr/lib/kompozer/kompozer-bin[0x804b971]
======= Memory map: ========
08048000-08057000 r-xp 00000000 08:01 1003852 /usr/lib/kompozer/kompozer-bin
08057000-08058000 r--p 0000f000 08:01 1003852 /usr/lib/kompozer/kompozer-bin
08058000-08059000 rw-p 00010000 08:01 1003852 /usr/lib/kompozer/kompozer-bin
08059000-0805a000 rw-p 08059000 00:00 0
08fb0000-08fd1000 rw-p 08fb0000 00:00 0 [heap]
b714a000-b714d000 rw-p b714a000 00:00 0
b714d000-b7151000 r-xp 00000000 08:01 1001448 /usr/lib/libXdmcp.so.6.0.0
b7151000-b7152000 rw-p 00003000 08:01 1001448 /usr/lib/libXdmcp.so.6.0.0
b7152000-b7154000 r-xp 00000000 08:01 1001437 /usr/lib/libXau.so.6.0.0
b7154000-b7155000 r--p 00001000 08:01 1001437 /usr/lib/libXau.so.6.0.0
b7155000-b7156000 rw-p 00002000 08:01 1001437 /usr/lib/libXau.so.6.0.0
b7156000-b717a000 r-xp 00000000 08:01 1001703 /usr/lib/libexpat.so.1.5.2
b717a000-b717c000 r--p 00023000 08:01 1001703 /usr/lib/libexpat.so.1.5.2
b717c000-b717d000 rw-p 00025000 08:01 1001703 /usr/lib/libexpat.so.1.5.2
b717d000-b717e000 rw-p b717d000 00:00 0
b717e000-b7196000 r-xp 00000000 08:01 1002412 /usr/lib/libxcb.so.1.1.0
b7196000-b7197000 r--p 00017000 08:01 1002412 /usr/lib/libxcb.so.1.1.0
b7197000-b7198000 rw-p 00018000 08:01 1002412 /usr/lib/libxcb.so.1.1.0
b7198000-b719e000 r-xp 00000000 08:01 1002410 /usr/lib/libxcb-render.so.0.0.0
b719e000-b719f000 r--p 00005000 08:01 1002410 /usr/lib/libxcb-render.so.0.0.0
b719f000-b71a0000 rw-p 00006000 08:01 1002410 /usr/lib/libxcb-render.so.0.0.0
b71a0000-b71a3000 r-xp 00000000 08:01 1002408 /usr/lib/libxcb-render-util.so.0.0.0
b71a3000-b71a4000 r--p 00002000 08:01 1002408 /usr/lib/libxcb-render-util.so.0.0.0
b71a4000-b71a5000 rw-p 00003000 08:01 1002408 /usr/lib/libxcb-render-util.so.0.0.0
b71a5000-b71c9000 r-xp 00000000 08:01 999708 /usr/lib/libpng12.so.0.27.0
b71c9000-b71ca000 r--p 00023000 08:01 999708 /usr/lib/libpng12.so.0.27.0
b71ca000-b71cb000 rw-p 00024000 08:01 999708 /usr/lib/libpng12.so.0.27.0
b71cb000-b71de000 r-xp 00000000 08:01 1001641 /usr/lib/libdirect-1.0.so.0.1.0
b71de000-b71df000 r--p 00012000 08:01 1001641 /usr/lib/libdirect-1.0.so.0.1.0
b71df000-b71e0000 rw-p 00013000 08:01 1001641 /usr/lib/libdirect-1.0.so.0.1.0
b71e0000-b71e1000 rw-p b71e0000 00:00 0
b71e1000-b71e8000 r-xp 00000000 08:01 1001725 /usr/lib/libfusion-1.0.so.0.1.0
b71e8000-b71e9000 r--p 00006000 08:01 1001725 /usr/lib/libfusion-1.0.so.0.1.0
b71e9000-b71ea000 rw-p 00007000 08:01 1001725 /usr/lib/libfusion-1.0.so.0.1.0
b71ea000-b724e000 r-xp 00000000 08:01 1001643 /usr/lib/libdirectfb-1.0.so.0.1.0
b724e000-b724f000 r--p 00063000 08:01 1001643 ...

[js (solard3ity-deactivatedaccount-deactivatedaccount)]

Kompozer has released a 0.8a ALPHA version wich can be downloaded at http://sourceforge.net/project/showfiles.php?group_id=170132&package_id=194013

It works and does the job for now...

[bert07 (marien.bert)]

Using Jaunty beta for desktop i386.
I can confirm this problem.

[carbon60 (carbon-60)]

I updated recent Jaunty on AMD64 and see the same probelem

[Peace75 (markspost)]

I also confirm the same error as above, using Jaunty 64 bit. Kompozer is unusable, and it seems there is no 64 bit version to use while this error exists.

[Jonas Pedersen (jonasped)]

I can confirm this one as well.

Using Kompozer version 1:0.7.10-0ubuntu5.

[carbon60 (carbon-60)]

are there other WYSIWYG web authoring tools like Kompozer available in Jaunty repository that I can use for now? Thanks.

[Knatchwa (rl-marr)]

Also confirm the error on AMD 64 based system using Jaunty Jackaloupe, previous to that kompozer would have other problems, anyone here tried the new alpha release and have seen any improvement?

[Knatchwa (rl-marr)]

@carbon60 you may also want to check out <a href="http://w3schools.com/">w3schools</a> and use a text editor. It's not as pretty but at the very least you can be pretty sure it will work.

[carbon60 (carbon-60)]

I have the latest Jaunty beta release. In fact, it worked in previous alpha releases. It breaks in the latest beta release. I have been using it although it got some issues (crashes here and there), but it was usable. Now it is totally useless. Does anyone do basic smoke test before releasing it?

[Peace75 (markspost)]

I went ahead and downloaded the latest version linked above by Jason Scurtu, its 32bit, although I use '64 bit' Jaunty the latest package seemed to run straight from folder extracted from that file, well for me anyway. I did have some 64 bit compatibility issues on first run, but after trying again it seems to load as usual, although I have not tested if it has full functionality yet.

[Saivann Carignan (oxmosys)]

Looking at svn changelog, there is some hope that I can bring back a working patch for current package. I'll see what I can do.

[Saivann Carignan (oxmosys)]

Unfortunately, I wasn't able to find which revision fixes this in kompozer svn. If nobody can get a fix, it might be interesting to bring 0.8 alpha in ubuntu rather than having a stable release which crash at start.

[Giuseppe Iuculano (giuseppe-iuculano)]

Saïvann Carignan ha scritto:
> Unfortunately, I wasn't able to find which revision fixes this in
> kompozer svn. If nobody can get a fix, it might be interesting to bring
> 0.8 alpha in ubuntu rather than having a stable release which crash at
> start.
>
> ** Changed in: kompozer (Ubuntu Jaunty)
> Assignee: Saïvann Carignan (saivann) => (unassigned)
>

Hi,

in case you will decide to bring 0.8 alpha in ubuntu, please use the package in
the debian git repository[1] (kompozer is in the Debian NEW queue[2]) and avoid
future delta.

[1]http://git.debian.org/?p=users/derevko-guest/kompozer.git
[2]http://ftp-master.debian.org/new/kompozer_0.7.10%2Bdfsg%2Bsvn117-1.html

Cheers,
Giuseppe.

[Kernel-1 (oligofrenolog)]

Confirmed, kompozer won't start (buffer overflow), Ubuntu 9.04 x_64

[Michael R. Head (burner)]

Also seeing this on Jaunty i386.

Is there a working .deb anywhere?

[Timothy Wilson (timothy-gbcwhittier)]

I hate to spam the list, but here's another confirmation of the problem.

I tried it as root and as my user. Below is as user.

$ kompozer
*** buffer overflow detected ***: /usr/lib/kompozer/kompozer-bin terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x37)[0x7f8d0fc552c7]
/lib/libc.so.6[0x7f8d0fc53170]
/lib/libc.so.6[0x7f8d0fc5382b]
/usr/lib/kompozer/kompozer-bin[0x407ab9]
/usr/lib/kompozer/kompozer-bin[0x404a0c]
/lib/libc.so.6(__libc_start_main+0xe6)[0x7f8d0fb745a6]
/usr/lib/kompozer/kompozer-bin[0x404939]
======= Memory map: ========
00400000-00411000 r-xp 00000000 08:16 78734150 /usr/lib/kompozer/kompozer-bin
00611000-00612000 r--p 00011000 08:16 78734150 /usr/lib/kompozer/kompozer-bin
00612000-00613000 rw-p 00012000 08:16 78734150 /usr/lib/kompozer/kompozer-bin
00613000-00614000 rw-p 00613000 00:00 0
018f9000-0191a000 rw-p 018f9000 00:00 0 [heap]
7f8d0c93a000-7f8d0c93f000 r-xp 00000000 08:16 78087733 /usr/lib/libXdmcp.so.6.0.0
7f8d0c93f000-7f8d0cb3e000 ---p 00005000 08:16 78087733 /usr/lib/libXdmcp.so.6.0.0
7f8d0cb3e000-7f8d0cb3f000 rw-p 00004000 08:16 78087733 /usr/lib/libXdmcp.so.6.0.0
7f8d0cb3f000-7f8d0cb41000 r-xp 00000000 08:16 78087722 /usr/lib/libXau.so.6.0.0
7f8d0cb41000-7f8d0cd40000 ---p 00002000 08:16 78087722 /usr/lib/libXau.so.6.0.0
7f8d0cd40000-7f8d0cd41000 r--p 00001000 08:16 78087722 /usr/lib/libXau.so.6.0.0
7f8d0cd41000-7f8d0cd42000 rw-p 00002000 08:16 78087722 /usr/lib/libXau.so.6.0.0
7f8d0cd42000-7f8d0cd69000 r-xp 00000000 08:16 78087988 /usr/lib/libexpat.so.1.5.2
7f8d0cd69000-7f8d0cf69000 ---p 00027000 08:16 78087988 /usr/lib/libexpat.so.1.5.2
7f8d0cf69000-7f8d0cf6b000 r--p 00027000 08:16 78087988 /usr/lib/libexpat.so.1.5.2
7f8d0cf6b000-7f8d0cf6c000 rw-p 00029000 08:16 78087988 /usr/lib/libexpat.so.1.5.2
7f8d0cf6c000-7f8d0cf87000 r-xp 00000000 08:16 78088696 /usr/lib/libxcb.so.1.1.0
7f8d0cf87000-7f8d0d186000 ---p 0001b000 08:16 78088696 /usr/lib/libxcb.so.1.1.0
7f8d0d186000-7f8d0d187000 r--p 0001a000 08:16 78088696 /usr/lib/libxcb.so.1.1.0
7f8d0d187000-7f8d0d188000 rw-p 0001b000 08:16 78088696 /usr/lib/libxcb.so.1.1.0
7f8d0d188000-7f8d0d18f000 r-xp 00000000 08:16 78088694 /usr/lib/libxcb-render.so.0.0.0
7f8d0d18f000-7f8d0d38f000 ---p 00007000 08:16 78088694 /usr/lib/libxcb-render.so.0.0.0
7f8d0d38f000-7f8d0d390000 r--p 00007000 08:16 78088694 /usr/lib/libxcb-render.so.0.0.0
7f8d0d390000-7f8d0d391000 rw-p 00008000 08:16 78088694 /usr/lib/libxcb-render.so.0.0.0
7f8d0d391000-7f8d0d394000 r-xp 00000000 08:16 78088692 /usr/lib/libxcb-render-util.so.0.0.0
7f8d0d394000-7f8d0d593000 ---p 00003000 08:16 78088692 /usr/lib/libxcb-render-util.so.0.0.0
7f8d0d593000-7f8d0d594000 r--p 00002000 08:16 78088692 /usr...

[Niffo (niffo)]

Same bug here in Jaunty i386 up to date on 2 different machines

[Antonio Sánchez (antoniosanchez)]

If this bug persist in Jaunty Final Release we need to include by default in Guadalinex Edu another WYSIWYG HTML Editor.

[Michael Vogt (mvo)]

I uploaded kompozer_0.8~alpha2+dfsg+svn129-1~ubuntu1_source.changes into my PPA. Its the package of Giuseppe Iuculano with a ubuntu version number (many thanks to him!).

Feedback from people who use it is much appreciated, I talk to motu-release next if it can still be uploaded or if it needs a SRU.

[David Erosa (erosa)]

@Michael Vogt:

I get this error when trying to update sing your PPA:

dpkg: error al procesar /var/cache/apt/archives/kompozer-data_1%3a0.8~alpha2+dfsg+svn129-1~ubuntu1_all.deb (--unpack):
 intentando sobreescribir `/usr/share/kompozer/icons/mozicon16.xpm', que está también en el paquete kompozer

[David Erosa (erosa)]

Well, after the error, if I do "apt-get -f install", both packages are installed correctly...

Anyway, now kompozer starts correctly and seems to be working ok.

[Michael Vogt (mvo)]

Asac uploaded a smaller patch here:
https://edge.launchpad.net/~asac/+archive/ppa

[Alexander Sack (asac)]

taking bug. this is critical (for kompozer package) as it means no kompozer at all.

Problem is a well known MAX_PATH overflow issue we had in all mozilla packages. Doubt, that the jaunty upload was ever tested ;).

[Alexander Sack (asac)]

subscribed motu-release to get a formal sign off. Debdiff attached.

[Alexander Sack (asac)]

uploaded kompozer_0.7.10-0ubuntu6_source.changes to ubuntu/jaunty

[Launchpad Janitor (janitor)]

This bug was fixed in the package kompozer - 1:0.7.10-0ubuntu6

---------------
kompozer (1:0.7.10-0ubuntu6) jaunty; urgency=low

  * fix LP: #347779 - kompozer crashes on startup because of buffer overflow
    detection of fortify
    - mozilla/toolkit/xre/nsAppRunner.h mozilla/xpcom/build/nsXPCOMPrivate.h

 -- Alexander Sack <email address hidden> Mon, 20 Apr 2009 18:01:04 +0200

[Antonio Sánchez (antoniosanchez)]

Comprobamos que el lanzamiento de kompozer_0.7.10-0ubuntu5_i386.deb ha resuelto el error.

[fiat1100d (gratteri-email)]

I confirm that the "ubuntu6" version on kompozer 0.7.10 works fine on Jaunty i386.

[Michael Vogt (mvo)]

Thanks Alex, works just fine for me now!