Re: LYNX-DEV Bug report?

[Klaus Weide]

On Thu, 12 Dec 1996, Randolph Chung wrote:
> I ran into a little problem when using lynx to access some pages at
> http://www.redhat.com/ (yes, I'm a linux user).
> 
> After a sequence of steps, lynx would segfault. The problem is somewhat
> reproducible -- turning tracing *ON* seems to prevent lynx from segfaulting...
> 
> Anyway, the URL I am trying to get to is password protected, so I cannot
> post it here. Basically, here's what I do to get it to segfault:
> 
> 1) go to http://www.redhat.com/redhat/dl.html
> 2) enter password in a form and submit it, the script 
> (http://www.redhat.com/redhat/dl.cgi) gives back a page with two links for
> downloading files.
>   a) http://www.redhat.com/redhat/dl.cgi/******/metroess-3.1.2-1.i38
>      (****** is the password)
>   b) ftp://metrob:address@hidden/3.1-manual.ps.Z
>   
> The first link works fine. The second is the one that causes trouble -- The
> url is apparently wrong. It is not accessible via either lynx or netscape,
> but if i press 'D'ownload on that link, I get back a "Unable to access
> document" message, and it takes me back to the page output by the script
> (with 2a and 2b above). If I quit lynx now, it will segfault.
> 
> I did an strace on the lynx process and got a trace, but it's a good ~80k,
> so i won't post it here. it's at http://tausq.ithaca.ny.us/~randolph/trace
> I'm not good at interpreting those traces, but I bet someone here is an
> expert :P
> 
> tausq[randolph]~> uname -a
> Linux tausq 2.0.25 #3 Sat Nov 9 23:57:29 EST 1996 i486
> tausq[randolph]~> lynx -version
> 
> Lynx Version 2.6
> (c)1996 GNU General Public License
> <URL:http://lynx.browser.org/>
> 
> (this is with the composite patches from Nov 20 or so)

I have looked at your trace output, cut it down, and annotated it to
the best of my understanding (see below).  My interpretation is that
Lynx does not recover correctly from a failed FTP retrieval, at least
under the given circumstances:  The FTP link was on a page which is
the result of a POST.

Just going by the description in Fote's CHANGES, there may have been
changes in the last few days that affect this handling, so I am not
sure whether the problem still exists in his latest development code
at <URL: http://www.wfbr.edu/dir/lynx>.

Checking with several older code sets shows that the problem does not
exist for FTP links from "normal" (i.e. non-POST) pages.  However in
all cases I found that lynx doesn't properly close the FTP socket
when recovering from this kind of failure (530 Login incorrect.)

Below the annotated trace.

   Klaus
** At this point, you are looking at the page
** <http://www.redhat.com/redhat/dl.html>.  You are moving down to
** the text field and entering something there, then move to the
** Download "button" and activate it:

select(3, [2], NULL, NULL, {3, 870000}) = 1 (in [2], left {2, 640000})
read(2, "\33", 1)                       = 1
select(3, [2], NULL, NULL, {10, 0})     = 1 (in [2], left {10, 0})
read(2, "[", 1)                         = 1
select(3, [2], NULL, NULL, {10, 0})     = 1 (in [2], left {10, 0})
read(2, "B", 1)                         = 1
write(1, "\33[3;4H\33[34;40mRed Hat\33[37;"..., 38) = 38

[ ... ]
read(2, "\r", 1)                        = 1
write(1, "\r\33[1m\33[33;44mSubmitting for"..., 42) = 42
write(1, "\r\33[33;44mGetting http://www.r";..., 52) = 52
write(1, "\rLooking up www.redhat.com.\33["..., 38) = 38

*** Lynx is submitting form as a POST request:
[ ... ]
connect(3, {sin_family=AF_INET, sin_port=htons(80), 
sin_addr=inet_addr("199.183.24.253")}, 16) = 0
ioctl(3, FIONBIO, [0])                  = 0
write(1, "\rSending HTTP request.\33[37;40"..., 33) = 33
write(3, "POST /redhat/dl.cgi HTTP/1.0\r\n"..., 1017) = 1017
write(1, "\r\33[33;44mHTTP request sent; w"..., 49) = 49
select(3, [2], NULL, NULL, {0, 0})      = 0 (Timeout)
select(1024, [3 266 294...1004], NULL, NULL, {0, 100000}) = 0 (Timeout)
[ ... ]
select(3, [2], NULL, NULL, {0, 0})      = 0 (Timeout)
select(1024, [3 266 294...1004], NULL, NULL, {0, 100000}) = 1 (in [3 
294...1004], left {0, 100000})
read(3, "HTTP/1.0 200 OK\r\nDate: Thu, 12"..., 1023) = 1023
write(1, "\rRead 1023 bytes of data.\33[37"..., 36) = 36
write(1, "\r\33[33;44mHTTP/1.0 200 OK\33[3"..., 35) = 35

*** Response to POST arrives, Lynx reads and displays page
[ ... ]
write(1, "\rData transfer complete\33[37;4"..., 34) = 34
close(3)                                = 0
[ ... ]

*** Here you press the 'd'ownload key on the link to the erroneous ftp URL:
write(1, "\33[8;17H\33[34;40mClick here to"..., 62) = 62
write(1, "\33[10;13H\33[0;10m\33[31;40mCli"..., 100) = 100
select(3, [2], NULL, NULL, {10, 0})     = 1 (in [2], left {8, 770000})
read(2, "d", 1)                         = 1

*** Lynx makes FTP connections, starts to receive data
write(1, "\r\33[1m\33[33;44mGetting ftp://";..., 82) = 82
write(1, "\r\33[33;44mLooking up ftp.redha"..., 46) = 46
[ ... ]
write(1, "\r\33[33;44mMaking FTP connectio"..., 49) = 49
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
ioctl(3, FIONBIO, [1])                  = 0
connect(3, {sin_family=AF_INET, sin_port=htons(21), 
sin_addr=inet_addr("199.183.24.251")}, 16) = -1 EINPROGRESS (Operation now in 
progress)
select(1024, NULL, [3 266 294...1004], NULL, {0, 100000}) = 1 (out [3 
294...1004], left {0, 0})
connect(3, {sin_family=AF_INET, sin_port=htons(21), 
sin_addr=inet_addr("199.183.24.251")}, 16) = 0
ioctl(3, FIONBIO, [0])                  = 0
select(3, [2], NULL, NULL, {0, 0})      = 0 (Timeout)
select(1024, [3 266 294...1004], NULL, NULL, {0, 100000}) = 1 (in [3 
294...1004], left {0, 30000})
read(3, "220-Please use a mirror if possi"..., 4096) = 37
[ ... ]

*** Lynx sends USER and PASS, which are rejected:
write(3, "USER metrob\r\n", 13)         = 13
[ ... ]
read(3, "530 Login incorrect.\r\n", 4096) = 22
write(1, "\rCan\'t Access `ftp://metrob:ma";..., 66) = 66
write(1, "\rAlert!: Unable to access docum"..., 46) = 46
[ ... ]

*** The download failed. Lynx should continue to display the current page
*** (which was the result of a POST request).  What it does is retrieve
*** that page again (by re-issuing the POST request).
*** Also note that socket 3, which was used in the FTP control connection
*** above, is never closed.
write(1, "\r\33[33;44mGetting http://www.r";..., 52) = 52
write(1, "\rLooking up www.redhat.com.\33["..., 38) = 38
[ ... ]
write(1, "\r\33[33;44mMaking HTTP connecti"..., 50) = 50
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 4
ioctl(4, FIONBIO, [1])                  = 0
connect(4, {sin_family=AF_INET, sin_port=htons(80), 
sin_addr=inet_addr("199.183.24.253")}, 16) = -1 EINPROGRESS (Operation now in 
progress)
select(1024, NULL, [4 266 293...1003], NULL, {0, 100000}) = 0 (Timeout)
connect(4, {sin_family=AF_INET, sin_port=htons(80), 
sin_addr=inet_addr("199.183.24.253")}, 16) = -1 EALREADY (Operation already in 
progress)
select(3, [2], NULL, NULL, {0, 0})      = 0 (Timeout)
select(1024, NULL, [4 266 293...1003], NULL, {0, 100000}) = 1 (out [4 
293...1003], left {0, 90000})
connect(4, {sin_family=AF_INET, sin_port=htons(80), 
sin_addr=inet_addr("199.183.24.253")}, 16) = 0
ioctl(4, FIONBIO, [0])                  = 0
write(1, "\rSending HTTP request.\33[37;40"..., 33) = 33
write(4, "POST /redhat/dl.cgi HTTP/1.0\r\n"..., 1016) = 1016
write(1, "\r\33[33;44mHTTP request sent; w"..., 49) = 49
select(3, [2], NULL, NULL, {0, 0})      = 0 (Timeout)
select(1024, [4 266 293...1003], NULL, NULL, {0, 100000}) = 0 (Timeout)
[ ... ]

*** The response to the POST request is arriving:
select(3, [2], NULL, NULL, {0, 0})      = 0 (Timeout)
select(1024, [4 266 293...1003], NULL, NULL, {0, 100000}) = 1 (in [4 
293...1003], left {0, 100000})
read(4, "HTTP/1.0 200 OK\r\nDate: Thu, 12"..., 1023) = 1023
write(1, "\rRead 1023 bytes of data.\33[37"..., 36) = 36
write(1, "\r\33[33;44mHTTP/1.0 200 OK\33[3"..., 35) = 35

*** Lynx is opening a temporary file.  This is what should have happened 
*** if the previous 'd'ownload had been successful, but should not happen
*** now for the text/html result of the POST request.  Apparently Lynx
*** got confused.
getpid()                                = 25459
open("/tmp/L254592TMP.html", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 5
write(1, "\r\33[33;44mContent-type: text/h"..., 32) = 32
[ ... ]
write(1, "\rRetrieving file.  - PLEASE WAI"..., 34) = 34
fstat(5, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
[ ... ]
read(4, "p=\"#pagemenu\"></a>\n<br clear="..., 4096) = 1491
write(1, "\33[25;3Had 1491 bytes of data.\33"..., 40) = 40
select(3, [2], NULL, NULL, {0, 0})      = 0 (Timeout)
select(3, [2], NULL, NULL, {0, 0})      = 0 (Timeout)
select(1024, [4 266 293...1003], NULL, NULL, {0, 100000}) = 1 (in [4 
293...1003], left {0, 100000})
read(4, "", 4096)                       = 0
write(1, "\r\33[33;44mData transfer comple"..., 42) = 42
close(4)                                = 0

*** Reading of response to POST request complete.  Lynx writes it to
*** temp file, than closes temp file.
write(5, "<BASE HREF=\"http://www.redhat.c";..., 2462) = 2462
close(5)                                = 0
[ ... ]

*** Another temp file is created, Lynx writes the html for Download menu
*** to it (normal processing for 'd'ownload, but should not happen here).
getpid()                                = 25459
open("/tmp/L254593TMP.html", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
[ ... ]
write(4, "<head>\n<title>Lynx Download Opt"..., 426) = 426
close(4)                                = 0
munmap(0x40007000, 4096)                = 0
stat("/tmp/L254593TMP.html", {st_mode=S_IFREG|0644, st_size=426, ...}) = 0

*** The temp file with tne Download menu is opened for reading and displayed:
open("/tmp/L254593TMP.html", O_RDONLY)  = 4
[ ... ]
read(4, "<head>\n<title>Lynx Download Opt"..., 4096) = 426
read(4, "", 4096)                       = 0
[ ... ]
close(4)                                = 0
munmap(0x40007000, 4096)                = 0
write(1, "\33[1;59HLynx Download Options\33"..., 400) = 400
write(1, "\n\33[33;44mCommands: Use arrow "..., 86) = 86
write(1, "\33[8;4H\33[0;10m\33[31;40mSave "..., 41) = 41

*** Here you press the left arrow key; that is the last thing before
*** the segfault occurs.
select(3, [2], NULL, NULL, {10, 0})     = 1 (in [2], left {9, 380000})
read(2, "\33", 1)                       = 1
select(3, [2], NULL, NULL, {10, 0})     = 1 (in [2], left {10, 0})
read(2, "[", 1)                         = 1
select(3, [2], NULL, NULL, {10, 0})     = 1 (in [2], left {10, 0})
read(2, "D", 1)                         = 1
--- SIGSEGV (Segmentation fault) ---
write(2, "\r\nA Fatal error has occurred i"..., 47) = 47
write(2, "\r\nPlease notify your system ad"..., 319) = 319
[ rest deleted ]

;
; To UNSUBSCRIBE:  Send a mail message to address@hidden
;                  with "unsubscribe lynx-dev" (without the
;                  quotation marks) on a line by itself.
;