infinite recursion with nested table and textarea

[kcwu]

$ xxd infinite-recursion
00000000: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000010: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000020: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000040: 3030 3030 3030 3030 3030 3030 3030 30e0  000000000000000.
00000050: 3030 3030 3030 3030 3c2f 3e30 3030 3030  00000000</>00000
00000060: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000070: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000080: 3030 3030 3030 3030 3030 303c 7461 626c  00000000000<tabl
00000090: 653e 3c74 6578 7461 7265 613e 3c74 6162  e><textarea><tab
000000a0: 6c65 2030 3030 303c 7465 7874 6172 6561  le 0000<textarea
000000b0: 3e3c 7461 626c 6520 3030 3030 3030 3030  ><table 00000000
000000c0: 3030 3030 3030 3030 303c 7465 7874 6172  000000000<textar
000000d0: 6561 3e3c 7461 626c 6520 303c 7465 7874  ea><table 0<text
000000e0: 6172 6561 3e3c 7461 626c 6520 3030 3030  area><table 0000
000000f0: 3030 3030 3030 303c 7465 7874 6172 6561  0000000<textarea
00000100: 3e3c 7461 626c 6520 3030 3030 3030 3030  ><table 00000000
00000110: 3030 3c74 6578 7461 7265 613e 3c74 6162  00<textarea><tab
00000120: 6c65 2030 3030 3030 3030 3030 3030 3c74  le 00000000000<t
00000130: 6578 7461 7265 613e 3c74 6162 6c65 3e3c  extarea><table><
00000140: 2f74 6162 6c65 3e                        /table>
$ gdb --args ./w3m -T text/html -dump infinite-recursion
Program received signal SIGSEGV, Segmentation fault.
0x0000000000445ad2 in renderCoTable (tbl=<error reading variable: Cannot access memory at address 0x7fffff7fedf8>, maxlimit=<error reading variable: Cannot access memory at address 0x7fffff7fedf4>) at table.c:1629
1629    {
(gdb) up
#1  0x000000000044643e in renderTable (t=0x7bf000, max_width=79, h_env=0x7fffff7ff500) at table.c:1794
1794        renderCoTable(t, h_env->limit);
(gdb)
#2  0x0000000000445d13 in renderCoTable (tbl=0x7bf000, maxlimit=79) at table.c:1654
1654            renderTable(t, maxwidth, &h_env);
(gdb)
#3  0x000000000044643e in renderTable (t=0x7bf000, max_width=79, h_env=0x7fffff7ffbe0) at table.c:1794
1794        renderCoTable(t, h_env->limit);

I found w3m called pushTable (tbl=0x7bf000, tbl1=0x7bf000) earlier.

This is found by afl-fuzz

[tats]

Reproducible, but not yet fixed. Patches welcome.

[kcwu]

Reduced test case

00000000: 3030 3030 3c6e 6f62 723e 3030 3030 3030  0000<nobr>000000
00000010: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000020: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000040: 3030 3030 303c 7461 626c 653e 3c74 6578  00000<table><tex
00000050: 7461 7265 613e 3c74 6162 6c65 2030 303c  tarea><table 00<
00000060: 7465 7874 6172 6561 3e3c 7461 626c 6520  textarea><table
00000070: 3e3c 2f74 6162 6c65 3e                   ></table>

[tats]

Workaround added. Thank you.

[kcwu]

The workaround can only prevent one level of recursion loop. But it is possible to have more than one level. For example,

00000000: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000010: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000020: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000040: 3030 3030 3030 3030 3030 3030 3020 3030  0000000000000 00
00000050: 3c6e 6f62 723e 3030 3030 3030 3030 3030  <nobr>0000000000
00000060: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000070: 3030 3030 303c 7461 626c 653e 3c74 6578  00000<table><tex
00000080: 7461 7265 613e 3c74 6162 6c65 3e3c 7465  tarea><table><te
00000090: 7874 6172 6561 3e3c 7461 626c 6500 3030  xtarea><table.00
000000a0: 3030 3030 3030 3e3c 7465 7874 6172 6561  000000><textarea
000000b0: 3e3c 7461 626c 6520 3030 3030 3030 3030  ><table 00000000
000000c0: 3e3c 7465 7874 6172 6561 3e3c 7461 626c  ><textarea><tabl
000000d0: 6520 3e3c 2f74 6162 6c65 3e              e ></table>

is 4 levels.

#0  0x0000000000445efd in renderCoTable (tbl=<error reading variable: Cannot access memory at address 0x7fffff7fee98>,
    maxlimit=<error reading variable: Cannot access memory at address 0x7fffff7fee94>) at table.c:1628
#1  0x00000000004469b1 in renderTable (t=0x7e7800, max_width=79, h_env=0x7fffff7ff5a0) at table.c:1810
#2  0x0000000000446270 in renderCoTable (tbl=0x7e0000, maxlimit=79) at table.c:1666
#3  0x00000000004469b1 in renderTable (t=0x7e0000, max_width=79, h_env=0x7fffff7ffc80) at table.c:1810
#4  0x0000000000446270 in renderCoTable (tbl=0x7e0800, maxlimit=79) at table.c:1666
#5  0x00000000004469b1 in renderTable (t=0x7e0800, max_width=79, h_env=0x7fffff800360) at table.c:1810
#6  0x0000000000446270 in renderCoTable (tbl=0x7c0000, maxlimit=79) at table.c:1666
#7  0x00000000004469b1 in renderTable (t=0x7c0000, max_width=79, h_env=0x7fffff800a40) at table.c:1810
#8  0x0000000000446270 in renderCoTable (tbl=0x7e7800, maxlimit=79) at table.c:1666
#9  0x00000000004469b1 in renderTable (t=0x7e7800, max_width=79, h_env=0x7fffff801120) at table.c:1810
#10 0x0000000000446270 in renderCoTable (tbl=0x7e0000, maxlimit=79) at table.c:1666
#11 0x00000000004469b1 in renderTable (t=0x7e0000, max_width=79, h_env=0x7fffff801800) at table.c:1810
#12 0x0000000000446270 in renderCoTable (tbl=0x7e0800, maxlimit=79) at table.c:1666
#13 0x00000000004469b1 in renderTable (t=0x7e0800, max_width=79, h_env=0x7fffff801ee0) at table.c:1810
#14 0x0000000000446270 in renderCoTable (tbl=0x7c0000, maxlimit=79) at table.c:1666
#15 0x00000000004469b1 in renderTable (t=0x7c0000, max_width=79, h_env=0x7fffff8025c0) at table.c:1810
#16 0x0000000000446270 in renderCoTable (tbl=0x7e7800, maxlimit=79) at table.c:1666
#17 0x00000000004469b1 in renderTable (t=0x7e7800, max_width=79, h_env=0x7fffff802ca0) at table.c:1810
#18 0x0000000000446270 in renderCoTable (tbl=0x7e0000, maxlimit=79) at table.c:1666
#19 0x00000000004469b1 in renderTable (t=0x7e0000, max_width=79, h_env=0x7fffff803380) at table.c:1810

[tats]

more than one level.

Fixed, thank you.

[kcwu]

The workaround still cannot handle all cases.

00000000: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000010: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000020: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000040: 3030 3030 3030 3030 3030 3030 3030 30e3  000000000000000.
00000050: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000060: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000070: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000080: 3c6e 3e30 3030 3030 303c 7461 626c 653e  <n>000000<table>
00000090: 3c74 6578 7461 7265 613e 3c74 6162 6c65  <textarea><table
000000a0: 0030 3030 3030 3030 3030 3030 3c74 6578  .00000000000<tex
000000b0: 7461 7265 613e 3c74 6162 6c65 3e3c 2f74  tarea><table></t
000000c0: 6162 6c65 3e3c 7461 626c 653e            able><table>

gdb

Program received signal SIGSEGV, Segmentation fault.
0x00000000004460d2 in renderCoTable (tbl=0x7c0000, maxlimit=45) at table.c:1660
1660            if (t->total_width == 0)
(gdb) p t
$1 = (struct table *) 0x0
(gdb) p cotable_level
$2 = 100

[tats]

(gdb) p t
$1 = (struct table *) 0x0

Fixed, thank you.