#268 Crash in htex_prescan_carry_over

[Felix Gatzemeier]

In a dvi file with hyperrefs, xdvi 22.84.9 (from teTeX
3.0) crashes reproducably when displaying a certain
page. The stack backtrace is:

#0 0x40280c2f in strlen () from /lib/libc.so.6
#1 0x080d5bf4 in xstrdup (s=0x0) at xstrdup.c:27
#2 0x0806c47a in htex_prescan_carry_over (old_page=0,
new_page=1)
at hypertex.c:442
#3 0x0804fbdc in prescan (fp=0x813b288) at dvi-draw.c:1809
#4 0x08068a5b in redraw_page () at events.c:5134
#5 0x0806908c in do_pages () at events.c:5359
#6 0x08088a17 in run_dvi_file (filename=0x8130168 "",
data=0x20)
at xdvi.c:3951
#7 0x08089804 in main (argc=2, argv=0xbffff774) at
xdvi.c:4328

Local variables and parameters are

(gdb) frame 0
#0 0x40280c2f in strlen () from /lib/libc.so.6
(gdb) info local
No symbol table info available.
(gdb) info args
No symbol table info available.
(gdb) frame 1
#1 0x080d5bf4 in xstrdup (s=0x0) at xstrdup.c:27
(gdb) info local
new_string = 0x0
(gdb) info args
s = 0x0
(gdb) frame 2
#2 0x0806c47a in htex_prescan_carry_over (old_page=0,
new_page=1)
at hypertex.c:442
(gdb) info local
No locals.
(gdb) info args
old_page = 0
new_page = 1
(gdb) frame 3
#3 0x0804fbdc in prescan (fp=0x813b288) at dvi-draw.c:1809
(gdb) info local
data = {pageno = 1, anchor_num = 1075674408, scan_type
= HTEX_ANCHOR_NUM}
pre_depth = 1
depth = 0
(gdb) info args
fp = (FILE *) 0x813b288
(gdb) frame 4
#4 0x08068a5b in redraw_page () at events.c:5134
(gdb) info local
rgbp = (const struct rgb *) 0x813b288
(gdb) info args
No arguments.
(gdb) frame 5
#5 0x0806908c in do_pages () at events.c:5359
(gdb) info local
errflag = 78161
(gdb) info args
No arguments.
(gdb) frame 6
#6 0x08088a17 in run_dvi_file (filename=0x8130168 "",
data=0x20)
at xdvi.c:3951
(gdb) info local
w = 135463272
title_name = 0x0
icon_name = 0x0
errflag = UNKNOWN_ERROR
add_w = 0
add_h = 0
main_win_w = 995
main_win_h = 1421
(gdb) info args
filename = 0x8130168 ""
data = (void *) 0x20
(gdb) frame 7
#7 0x08089804 in main (argc=2, argv=0xbffff774) at
xdvi.c:4328
(gdb) info local
cmdline_db = 0x81364c8
i = 0
info = {file_idx = 0, page_arg = 0x0}
file_name = 0x812f138
"/home/fxg/share/Work/DissF/tests/E2T.dvi"
file_name2 = 0x8104c20 "8\002"
argc_bak = 0
argv_bak = (char **) 0x811a8a0
(gdb) info args
argc = 2
argv = (char **) 0xbffff774

I haven't yet tried to minimize the file, but could
provide it as is for closer inspection. I found it
strange that in prescan, depth=0 but htex_... is called
in an if-branch with condition "depth>0". I blame that
on optimization, but couldn't find out more because gdb
crashed when stepping through prescan.

[Stefan Ulrich]

Logged In: YES
user_id=177175

Thanks for the report - yes, please email me the file
(stefanulrich AT users.sourceforge.net) and indicate on
which page it happens.

[Felix Gatzemeier]

Logged In: YES
user_id=652953

Done.

[Stefan Ulrich]

Logged In: YES
user_id=177175

For the record, I can reproduce the bug by invoking `xdvi
+28 E2T.dvi'. Assigning to myself.

[Stefan Ulrich]

Logged In: YES
user_id=177175

Probably the same bug is

http://sourceforge.net/tracker/index.php?func=detail&aid=1344956&group_id=23164&atid=377580

[Stefan Ulrich]

Logged In: YES
user_id=177175
Originator: NO

Fixed in rev. 1.179.2.38 of hypertex.c.