MantisBT - LibCSS
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0002854LibCSSLibCSSpublic2023-03-31 01:552023-03-31 17:30
Reporterphoebos 
Assigned To 
PrioritynormalSeveritycrashReproducibilityalways
StatusnewResolutionopen 
Platformx86_64OSLinuxOS Version5.15.104
Fixed in CI build #
Reported in CI build #
Summary0002854: Netsurf segmentation fault in libcss
DescriptionViewing the page https://stackoverflow.com/questions/45981545/why-does-noreturn-function-return
causes a segfault.
Steps To Reproducerun "netsurf-gtk3 https://stackoverflow.com/questions/45981545/why-does-noreturn-function-return" for libcss and netsurf at latest git commit.
Additional Informationbacktrace:

#0 css__select_revert_property_to_origin
    (select_state=0x7fffffffa2a0, prop_state=0x7fffffffb418, origin=CSS_ORIGIN_USER, pseudo=CSS_PSEUDO_ELEMENT_NONE, property=CSS_PROP_OUTLINE_COLOR)
    at src/select/select.c:1168
#1 0x0000555555793bd4 in css__select_revert_property
    (select_state=select_state@entry=0x7fffffffa2a0, prop_state=prop_state@entry=0x7fffffffb418, pseudo=pseudo@entry=CSS_PSEUDO_ELEMENT_NONE, property=property@entry=CSS_PROP_OUTLINE_COLOR) at src/select/select.c:1193
0000002 0x00005555557961d1 in css_select_style
    (ctx=<optimized out>, node=node@entry=0x7ffff4334980, unit_ctx=unit_ctx@entry=0x7ffff4525cb0, media=media@entry=0x7ffff4525c50, inline_style=inline_style@entry=0x0, handler=handler@entry=0x555555a01d80 <selection_handler>, pw=0x7fffffffbf50, result=0x7fffffffbf00) at src/select/select.c:1406
#3 0x00005555556939ad in nscss_get_style
    (ctx=ctx@entry=0x7fffffffbf50, n=n@entry=0x7ffff4334980, media=media@entry=0x7ffff4525c50, unit_len_ctx=unit_len_ctx@entry=0x7ffff4525cb0, inline_style=inline_style@entry=0x0) at content/handlers/css/select.c:264
#4 0x0000555555693e66 in box_get_style
    (c=0x7ffff4525a40, parent_style=0x7ffff3d70ab0, root_style=0x7ffff42d7b10, n=0x7ffff4334980) at content/handlers/html/box_construct.c:286
#5 0x000055555569450c in box_construct_element
    (ctx=ctx@entry=0x7ffff3608fe0, convert_children=convert_children@entry=0x7fffffffc07b) at content/handlers/html/box_construct.c:495
#6 0x000055555569572f in convert_xml_to_box (ctx=0x7ffff3608fe0)
    at content/handlers/html/box_construct.c:1240
#7 0x0000555555742c5d in schedule_run () at frontends/gtk/schedule.c:148
#8 0x0000555555738908 in nsgtk_main () at frontends/gtk/gui.c:1072
#9 0x00005555555e721c in main (argc=<optimized out>, argv=<optimized out>)
    at frontends/gtk/gui.c:1231
TagsNo tags attached.
Relationships
Attached Files? log (47,949) 2023-03-31 01:55
https://bugs.netsurf-browser.org/mantis/file_download.php?file_id=728&type=bug

Notes
(0002412)
phoebos   
2023-03-31 10:57   
The null dereference in src/select/select.c:1168 causes this segfault, and has been detected by your static analysis CI system for at least 4 months:

https://ci.netsurf-browser.org/jenkins/job/scan-build-libcss/361/clangScanBuildBugs/
(0002413)
phoebos   
2023-03-31 17:30   
ASAN output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==179658==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000026e8 (pc 0x55f51d0c51f3 bp 0x000000000000 sp 0x7ffe57f77c60 T0)
==179658==The signal is caused by a READ memory access.
    #0 0x55f51d0c51f3 in css__select_revert_property_to_origin /tmp/21803/build/libcss/src/select/select.c:1168:40
    #1 0x55f51cbe66a2 in __sanitizer::BufferedStackTrace::UnwindImpl(unsigned long, unsigned long, void*, bool, unsigned int) Scrt1.c
    0000002 0x55f51cc12e5b in __sanitizer::ReportDeadlySignal(__sanitizer::SignalContext const&, unsigned int, void (*)(__sanitizer::SignalContext const&, void const*, __sanitizer::BufferedStackTrace*), void const*) Scrt1.c
    #3 0x55f51cbe0d53 in __asan::ScopedInErrorReport::~ScopedInErrorReport() Scrt1.c
    #4 0x55f51cbe109d in __asan::ReportDeadlySignal(__sanitizer::SignalContext const&) Scrt1.c
    #5 0x55f51cbdf62d in __asan::AsanOnDeadlySignal(int, void*, void*) Scrt1.c
    #6 0x7f1aacb3e733 in _setjmp /tmp/852136/build/musl/src/signal/x86_64/restore.s:1

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/21803/build/libcss/src/select/select.c:1168:40 in css__select_revert_property_to_origin
==179658==ABORTING

Issue History
Date ModifiedUsernameFieldChange
2023-03-31 01:55phoebosNew Issue
2023-03-31 01:55phoebosFile Added: log
2023-03-31 10:57phoebosNote Added: 0002412
2023-03-31 17:30phoebosNote Added: 0002413