MantisBT - NetSurf |
| View Issue Details |
|
| ID | Project | Category | View Status | Date Submitted | Last Update |
| 0002459 | NetSurf | [All Projects] General | public | 2016-08-11 21:42 | 2016-11-22 21:59 |
|
| Reporter | Sergei Rogachev | |
|---|
| Assigned To | | |
|---|
| Priority | normal | Severity | crash | Reproducibility | have not tried |
|---|
| Status | closed | Resolution | open | |
|---|
| Platform | | OS | | OS Version | |
|---|
| Product Version | | |
|---|
| Target Version | | Fixed in Version | 3.6 | |
|---|
| Fixed in CI build # | 3662 |
|---|
| Reported in CI build # | |
|---|
| URL of problem page | |
|---|
|
| Summary | 0002459: NetSurf crashes on failed initialization of libjpeg context |
|---|
| Description | The function jpeg_create_decompress() jumps to incorrectly filled jump buffer to handle an exception. It results to segmentation fault.
---
Libjpeg used in NetSurf for decoding of JPEG images handles exceptions using a pair of non-local jump functions: setjmp() and longjmp(). When a decompression context is created via a call to the function jpeg_create_decompress() the caller passes a structure jpeg_decompress_struct as a parameter. This structure should has a validly initialized jump buffer, so the initialization or other functions called in future can jump to the exception handling context.
The jpeg backend of NetSurf now initializes libjpeg mistakenly: jump buffer is filled after the call to jpeg_create_decompress(). It results in jump to random addresses in the case of exception caught during operation of the function jpeg_create_decompress().
The patch from the attachment moves the initialization of jump buffer before the call to jpeg_create_decompress(). |
|---|
| Additional Information | The attached file is a patch fixing the mentioned issue. I already tried to send the patch to the developers' mailing list, but received and automatical reply that I have not enough authority to post messages to that list. |
|---|
| Tags | No tags attached. |
|---|
| Relationships | |
| Attached Files |  0001-Fix-longjmp-to-invalid-address-on-jpeg-init-error.patch (1,959) 2016-08-11 21:42
https://bugs.netsurf-browser.org/mantis/file_download.php?file_id=438&type=bug |
|---|