From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Paul Eggert Newsgroups: gmane.emacs.bugs Subject: bug#14345: 24.3; shr-insert-document crashes gtk-emacs Date: Sun, 12 May 2013 12:21:21 -0700 Organization: UCLA Computer Science Department Message-ID: <518FEBB1.1060905@cs.ucla.edu> References: <87bo8rihxe.fsf@zancas.localnet> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1368386510 1498 80.91.229.3 (12 May 2013 19:21:50 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sun, 12 May 2013 19:21:50 +0000 (UTC) To: 14345-done@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sun May 12 21:21:49 2013 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1Ubbq7-0005Bg-UJ for geb-bug-gnu-emacs@m.gmane.org; Sun, 12 May 2013 21:21:48 +0200 Original-Received: from localhost ([::1]:46987 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Ubbq7-0001mj-HI for geb-bug-gnu-emacs@m.gmane.org; Sun, 12 May 2013 15:21:47 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:48808) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Ubbq1-0001lW-L3 for bug-gnu-emacs@gnu.org; Sun, 12 May 2013 15:21:44 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Ubbq0-0006pp-Mv for bug-gnu-emacs@gnu.org; Sun, 12 May 2013 15:21:41 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:33644) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Ubbq0-0006pj-J0 for bug-gnu-emacs@gnu.org; Sun, 12 May 2013 15:21:40 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.72) (envelope-from ) id 1UbbqM-0006q5-Qi for bug-gnu-emacs@gnu.org; Sun, 12 May 2013 15:22:02 -0400 In-Reply-To: <87bo8rihxe.fsf@zancas.localnet> Resent-From: Paul Eggert Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-To: bug-gnu-emacs@gnu.org Resent-Date: Sun, 12 May 2013 19:22:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: cc-closed 14345 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: confirmed Mail-Followup-To: 14345@debbugs.gnu.org, eggert@cs.ucla.edu, david@tethera.net Original-Received: via spool by 14345-done@debbugs.gnu.org id=D14345.136838651326260 (code D ref 14345); Sun, 12 May 2013 19:22:02 +0000 Original-Received: (at 14345-done) by debbugs.gnu.org; 12 May 2013 19:21:53 +0000 Original-Received: from localhost ([127.0.0.1]:37753 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.72) (envelope-from ) id 1UbbqC-0006pU-P1 for submit@debbugs.gnu.org; Sun, 12 May 2013 15:21:53 -0400 Original-Received: from smtp.cs.ucla.edu ([131.179.128.62]:46416) by debbugs.gnu.org with esmtp (Exim 4.72) (envelope-from ) id 1UbbqA-0006pI-16 for 14345-done@debbugs.gnu.org; Sun, 12 May 2013 15:21:51 -0400 Original-Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp.cs.ucla.edu (Postfix) with ESMTP id 4CEDE39E8109 for <14345-done@debbugs.gnu.org>; Sun, 12 May 2013 12:21:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at smtp.cs.ucla.edu Original-Received: from smtp.cs.ucla.edu ([127.0.0.1]) by localhost (smtp.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nRUjHJ7mDIE7 for <14345-done@debbugs.gnu.org>; Sun, 12 May 2013 12:21:25 -0700 (PDT) Original-Received: from [192.168.1.9] (pool-71-189-154-249.lsanca.fios.verizon.net [71.189.154.249]) by smtp.cs.ucla.edu (Postfix) with ESMTPSA id 2751C39E8100 for <14345-done@debbugs.gnu.org>; Sun, 12 May 2013 12:21:25 -0700 (PDT) User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130404 Thunderbird/17.0.5 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.13 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:74191 Archived-At: I installed the following patch as trunk bzr 112562 to fix this. It works for me, including for Glenn's C-c C-c test. I'll cross my fingers and mark the bug as fixed. === modified file 'src/ChangeLog' --- src/ChangeLog 2013-05-09 18:30:46 +0000 +++ src/ChangeLog 2013-05-12 19:14:22 +0000 @@ -1,3 +1,7 @@ +2013-05-12 Paul Eggert + + * image.c (gif_load): Check that subimages fit (Bug#14345). + 2013-05-09 Stefan Monnier * lread.c (skip_dyn_eof): New function. === modified file 'src/image.c' --- src/image.c 2013-04-07 04:41:19 +0000 +++ src/image.c 2013-05-12 19:15:38 +0000 @@ -7263,6 +7263,25 @@ return 0; } + /* Check that the selected subimages fit. It's not clear whether + the GIF spec requires this, but Emacs can crash if they don't fit. */ + for (j = 0; j <= idx; ++j) + { + struct SavedImage *subimage = gif->SavedImages + j; + int subimg_width = subimage->ImageDesc.Width; + int subimg_height = subimage->ImageDesc.Height; + int subimg_top = subimage->ImageDesc.Top; + int subimg_left = subimage->ImageDesc.Left; + if (! (0 <= subimg_width && 0 <= subimg_height + && 0 <= subimg_top && subimg_top <= height - subimg_height + && 0 <= subimg_left && subimg_left <= width - subimg_width)) + { + image_error ("Subimage does not fit in image", Qnil, Qnil); + fn_DGifCloseFile (gif); + return 0; + } + } + /* Create the X image and pixmap. */ if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap)) {