Re: [Lynx-dev] lynx2.8.6dev.9

[Gisle Vanem]

This version built with djgpp and S-Lang crashes due to (AFAICS)
wrong use of HTSACopy/StrAllocCopy. Backtrace:

Lynx now exiting with signal:  291

Abort!
Exiting due to signal SIGABRT
General Protection Fault at eip=00285c2b
eax=00650000 ebx=003e922e ecx=003e9232 edx=ffa139a8 esi=00000beb edi=0038a610
ebp=00389a78 esp=00389a70 program=E:\NET\LYNX28\LYNX.EXE
cs: sel=019f  base=02a30000  limit=003fffff
ds: sel=01a7  base=02a30000  limit=003fffff
es: sel=01a7  base=02a30000  limit=003fffff
fs: sel=01b7  base=00000000  limit=0010ffff
gs: sel=01b7  base=00000000  limit=0010ffff
ss: sel=01a7  base=02a30000  limit=003fffff
App stack: [0038aed8..0030aedc]  Exceptn stack: [0030a098..00308158]

Call frame traceback EIPs:
 0x00285c2b   free+75, file infostrc.c
 0x000d274e   HTSACopy+39, file HTString.c, line 262
 0x000ac546   LYCheckForProxyURL+161, file LYutils.c, line 2012
 0x000ad1fd   is_url+2492, file LYutils.c, line 2405
 0x00049b40   LYLegitimizeHREF+483, file LYcharut.c, line 3044
 0x0002d377   HTML_start_element+927, file HTML.c, line 2859
 0x000dc7a0   start_element+790, file SGML.c, line 1296
 0x000e1431   SGML_character+2328, file SGML.c, line 3435
 0x000e394d   SGML_write+49, file SGML.c, line 4354
 0x000eecdc   HTFileCopy+277, file HTFormat.c, line 924
 0x000efa9f   HTParseFile+54, file HTFormat.c, line 1449
 0x000e9489   decompressAndParse+25, file HTFile.c, line 2377
 0x000ea38d   HTLoadFile+55, file HTFile.c, line 2773
 0x000d8255   HTLoad+199, file HTAccess.c, line 696
 0x000d8c9c   HTLoadDocument+487, file HTAccess.c, line 928
 0x000d943c   HTLoadAbsolute+76, file HTAccess.c, line 1110
 0x00059a31   getfile+211, file LYgetfil.c, line 829
 0x000801a7   mainloop+236, file LYmainlo.c, line 5501
 0x0006ed4c   main+1689, file LYmain.c, line 2149
 0x0028585f   __crt1_startup+191, file crt1.c

---------

In HTSACopy, line 262 there's a FREE(*dest), but I cannot see
that '*dest' was malloced in LYCheckForProxyURL():

if ((cp1 = strchr((cp + 1), ':')) != NULL) {
    if ((cp2 = strchr((cp + 1), '/')) != NULL && cp2 < cp1)
        return (NOT_A_URL_TYPE);
    *cp1 = '\0';
    StrAllocCopy(cp2, cp);       << this caused free() to crash.

Isn't *dest = cp2? So it is clealy not malloced. I'm on a limb here,
but this patch works here:

--- lyutils.c.orig      2004-12-30 11:12:00
+++ lyutils.c   2004-12-30 18:45:04 +0100
@@ -2009,7 +2009,7 @@
       if ((cp2 = strchr((cp + 1), '/')) != NULL && cp2 < cp1)
           return (NOT_A_URL_TYPE);
       *cp1 = '\0';
-       StrAllocCopy(cp2, cp);
+        StrAllocCopy(cp1, cp2);
       *cp1 = ':';
       StrAllocCat(cp2, "_proxy");
       if (LYGetEnv(cp2) != NULL) {

--gv