Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

segfault when iso2022 parsing #14

Closed
kcwu opened this issue Aug 16, 2016 · 1 comment

Comments

Projects
None yet
2 participants
@kcwu
Copy link
Contributor

commented Aug 16, 2016

$ echo -e '<meta charset=gb18030>\n<a target=\x80><meta charset=hz>\n\x1b' | ./w3m -T text/html -dump

Program received signal SIGSEGV, Segmentation fault.
0x0000000000481b3d in wc_push_to_iso2022 (os=0x7cc2c0, cc=..., st=0x7fffffffc7d0) at iso2022.c:408
408             g = cs94_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
(gdb) p cc.ccs
$1 = 256
(gdb) bt
#0  0x0000000000481b3d in wc_push_to_iso2022 (os=0x7cc2c0, cc=..., st=0x7fffffffc7d0) at iso2022.c:408
#1  0x000000000047edb2 in wc_conv_to_ces (is=0x7cc2e0, ces=2099217) at conv.c:93
#2  0x000000000047eacf in wc_Str_conv (is=0x7cc2e0, f_ces=3211264, t_ces=2099217) at conv.c:23
#3  0x000000000047eb32 in wc_Str_conv_strict (is=0x7cc2e0, f_ces=3211264, t_ces=2099217) at conv.c:37
#4  0x000000000042903c in HTMLlineproc2body (buf=0x7cee00, feed=0x427fa1 <textlist_feed>, llimit=-1) at file.c:5664
#5  0x000000000042aba1 in HTMLlineproc2 (buf=0x7cee00, tl=0x7cc5e0) at file.c:6173
#6  0x000000000042dd6e in loadHTMLstream (f=0x7fffffffd120, newBuf=0x7cee00, src=0x0, internal=0) at file.c:7258
#7  0x000000000042c597 in loadHTMLBuffer (f=0x7fffffffd120, newBuf=0x7cee00) at file.c:6755
#8  0x0000000000416a40 in loadSomething (f=0x7fffffffd120, loadproc=0x42c4b2 <loadHTMLBuffer>, defaultbuf=0x7cee00) at file.c:224
#9  0x000000000041c7e6 in loadGeneralFile (path=0x7c3ae0 "/tmp/zshWcHIdH", current=0x0, referer=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>,
    flag=0, request=0x0) at file.c:2241
#10 0x00000000004070d1 in main (argc=5, argv=0x7fffffffd448, envp=0x7fffffffd478) at main.c:1020

found by afl-fuzz

tats added a commit that referenced this issue Aug 18, 2016

@tats

This comment has been minimized.

Copy link
Owner

commented Aug 18, 2016

Fixed, thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.