Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)

Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)

[Michael Schierl]

Please write in English if possible, because the Emacs maintainers
usually do not have translators to read other languages for them.

Your bug report will be posted to the bug-gnu-emacs@gnu.org mailing list,
and to the gnu.emacs.bug news group.

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:



It was a bit hard to reproduce. In fact, I tried to make up a valid xbm
:data chunk, and failed (any hints for a working example
appreciated...), because my Emacs crashed too often.

There are lots of ways to crash Emacs (just work with it for a while
while there are lots of broken xbm images in your buffer), but here is a
reproducable one:


- start emacs -Q
- run this in *scratch* buffer

(progn
  (put-image '(image :type pbm :data "") 0)
  (pop-to-buffer "*Messages*")
  (goto-char (point-max)))

Now press <down> <right> <down> <right>.

When Emacs asks you whether you want to attach a debugger, answer
whatever you find appropriate :)

Sorry, no gdb available here, but I guess this is pretty reproducable
for those who have one.


In GNU Emacs 22.1.1 (i386-mingw-nt5.1.2600)
 of 2007-06-02 on RELEASE
Windowing system distributor `Microsoft Corp.', version 5.1.2600
configured using `configure --with-gcc (3.4) --cflags -Ic:/gnuwin32/include'

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: DEU
  locale-coding-system: cp1252
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  encoded-kbd-mode: t
  tooltip-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  line-number-mode: t

Recent input:
M-x r e p o r t <tab> <return>

Recent messages:
("D:\\Progs\\emacs\\bin\\emacs.exe" "-Q")
Loading encoded-kb...done
For information about the GNU Project and its goals, type C-h C-p.
Loading emacsbug...
Loading regexp-opt...done
Loading emacsbug...done

Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)

[Michael Schierl]

Michael Schierl schrieb:

> It was a bit hard to reproduce. In fact, I tried to make up a valid xbm
> :data chunk, and failed (any hints for a working example
> appreciated...), because my Emacs crashed too often.

Sorry, this should have been xpm (and not xbm and not pbm in the
subject). And also in the bug report below it should be :type xpm,
although it crashes with :type pbm as well.

(I want to create a color image "on the fly", and thought that xpm
should be easiest and best supported)

> (progn
>   (put-image '(image :type xpm :data "") 0)
>   (pop-to-buffer "*Messages*")
>   (goto-char (point-max)))
> 
> Now press <down> <right> <down> <right>.


Sorry for the confusion,

Michael

Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)

[Juanma Barranquero]

On 6/15/07, Michael Schierl <schierlm@gmx.de> wrote:

> Sorry, this should have been xpm (and not xbm and not pbm in the
> subject). And also in the bug report below it should be :type xpm,
> although it crashes with :type pbm as well.

It's perfectly reproducible, yes.

It is aborting in temp_set_point_both, in the "charpos > BUF_ZV
(buffer)" comparison. In test runs, I get charpos == 316, BUF_ZV
(buffer) = 293.

Time for someone versed in redisplay.

#0  0x7c911231 in _end__ ()
#1  0x01135627 in w32_abort () at w32fns.c:9087
#2  0x01119ed7 in temp_set_point_both (buffer=0x16c1200, charpos=350,
    bytepos=350) at intervals.c:1954
#3  0x0102a503 in redisplay_window (window=24978436, just_this_one_p=0)
    at xdisp.c:13523
#4  0x0102c924 in redisplay_window_0 (window=24978436) at xdisp.c:11790
#5  0x0100a0b4 in internal_condition_case_1 (
    bfun=0x102c8fa <redisplay_window_0>, arg=24978436, handlers=23807125,
    hfun=0x101f526 <redisplay_window_error>) at eval.c:1529
#6  0x0101f308 in redisplay_windows (window=2089944429) at xdisp.c:11769
#7  0x0101f2c9 in redisplay_windows (window=2089944429) at xdisp.c:11763
#8  0x0102e417 in redisplay_internal (preserve_echo_area=6) at xdisp.c:11329
#9  0x010596b9 in read_char (commandflag=1, nmaps=3, maps=0x82fb40,
    prev_event=23824385, used_mouse_menu=0x82fb88, end_time=0x0)
    at keyboard.c:2670
#10 0x0105ae41 in read_key_sequence (keybuf=0x82fcb0, bufsize=30,
    prompt=23824385, dont_downcase_last=0, can_return_switch_frame=1,
    fix_current_buffer=1) at keyboard.c:9218
#11 0x0105c617 in command_loop_1 () at keyboard.c:1618
#12 0x0100a347 in internal_condition_case (bfun=0x105c486 <command_loop_1>,
    handlers=23892617, hfun=0x105645e <cmd_error>) at eval.c:1481
#13 0x01050656 in command_loop_2 () at keyboard.c:1329
#14 0x0100a27c in internal_catch (tag=23882753,
    func=0x1050633 <command_loop_2>, arg=23824385) at eval.c:1222
#15 0x010504a3 in command_loop () at keyboard.c:1308
#16 0x01050537 in recursive_edit_1 () at keyboard.c:1006
#17 0x0105061c in Frecursive_edit () at keyboard.c:1067
#18 0x01002a2b in main (argc=2, argv=0xf826a8) at emacs.c:1768
#19 0x01001247 in __mingw_CRTStartup ()
#20 0x01001298 in mainCRTStartup ()
#21 0x7c816fd7 in _end__ ()

             Juanma

Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)

[Jason Rumney]

>> (progn
>>   (put-image '(image :type xpm :data "") 0)
>>   (pop-to-buffer "*Messages*")
>>   (goto-char (point-max)))
>>
>> Now press <down> <right> <down> <right>.
>>     

This crashes X as well. I think the bug is caused by moving point in
*Messages* as it reaches messages-buffer-max-lines. The crash is caused
by point being greater than point-max.

There doesn't seem to be a problem with the handling of malformed PBMs
and XBMs, this is just a catalyst to cause error messages to be appended
to the *Messages* buffer.

Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)

[Juanma Barranquero]

On 6/17/07, Jason Rumney <jasonr@gnu.org> wrote:

> This crashes X as well. I think the bug is caused by moving point in
> *Messages* as it reaches messages-buffer-max-lines. The crash is caused
> by point being greater than point-max.

My messages-buffer-max-lines is 1000. *Messages* has about 35 lines.

             Juanma