[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-devel
Subject:    Re: misc kfm bug reports
From:       Johannes Sixt <Johannes.Sixt () telecom ! at>
Date:       1997-12-14 21:23:52
[Download RAW message or body]

On Sun, 14 Dec 1997, Roger Espel Llima wrote:
>4)
>When displaying html text, apostrophes (') are rendered as double quotes
>(").  I have not been able to reproduce this on a Linux box also running
>KDE beta2.

I do see this (especially in kmail). This is KDE Beta2 on SuSE Linux 5.0.

>10)
>when a link (<a href="...">) refers to an URL (http: or file:) with a
>long name (over 300 chars), clicking on the link and having it fail
>(file not found, or 403 forbidden), results in a crash (bus error).  It
>seems like the crash occurs at the time of displaying the error message!
>
>output:
>KIOSlave-ERROR (file:/users/93/maths/espel/public_html/blah...): Can't
>open File for reading; File name too long
>******** EXIT ********
>zsh: bus error  ./kfm
>
>backtrace:
>
>#0  0xdf20af9c in t_splay ()
>#1  0xdf20adf4 in t_delete ()
>#2  0xdf20a754 in realloc ()
>#3  0xdf52b4f4 in QGArray::resize ()
>#4  0xdf533f54 in QString::resize ()
>#5  0xdf534000 in QString::sprintf ()
>#6  0xa59e4 in KIOJob::fatalError () at kiojob.cpp:1108
>[...]
>[ at msg.sprintf time (kiojob.cpp:1108), _url seems to be non-NULL, so
>  why does it crash? ]

Dear developers! Please be very cautious when you are using 
QString::sprintf!!!  It doesn't automatically increase the QString
buffer to the needed size, it only uses 256 bytes, which is
sometimes too little, especially if what
is formatted into the string is under the user's control (text input,
file names and such - consider the case where a user accidentally
pastes huge amounts of text into an edit window...).
Use operator+ to construct potentially long texts, or (if it is possible
to estimate the resulting length) use QString::QString(int) to allocate
a large enough buffer:
      QString msg(strlen(url) + 35);   // estimate resulting length
      msg.sprintf("erroneous url: %s\nCan't continue", url);

Here's another KFM problem: When I press the Stop
toolbar button (e.g. while kfm expands a large tar.gz file), it
somtimes crashes
with the hint "virtual memory exhausted in new". Since I've lots
of memory, I suppose that the value of an uninitialized variable is
passed to operator new[] somewhere.

-- Hannes

[prev in list] [next in list] [prev in thread] [next in thread]