Re: [Lynx-dev] Re: lynx hangs II: the return

[Thomas Dickey]

On Tue, Feb 26, 2008 at 06:15:27PM +0100, Paul B. Mahol wrote:
> On 2/26/08, Thomas Dickey <address@hidden> wrote:
> > I looked into this a little last night, and see that it's likely a
> > problem comparing signed/unsigned values somewhere. I made a workaround
> > which is in the lynx-patch in ftp://invisible-island.net/temp/
> > diff -Nur lynx2-8-7 lynx2-8-7Y
> 
> Please recheck this patch.

Changing that to an HTMIN seems to make sense (it's been that way since
2.8.3dev.17) , but opens up a bug in the code.  Here's part of the output
from valgrind:

==15261== Invalid write of size 4
==15261==    at 0x80E2B6C: Stbl_reserveCellsInRow (TRSTable.c:542)
==15261==    by 0x80E3B3C: Stbl_reserveCellsInTable (TRSTable.c:990)
==15261==    by 0x80E506D: Stbl_addCellToTable (TRSTable.c:1482)
==15261==    by 0x806342A: HText_startStblTD (GridText.c:5007)
==15261==    by 0x80C13DC: HTML_start_element (HTML.c:5553)
==15261==    by 0x810DDF1: start_element (SGML.c:1306)
==15261==    by 0x8112B20: SGML_character (SGML.c:3485)
==15261==    by 0x811503B: SGML_write (SGML.c:4408)
==15261==    by 0x81204FE: HTFileCopy (HTFormat.c:925)
==15261==    by 0x8120FE6: HTParseFile (HTFormat.c:1455)
==15261==  Address 0x4480b24 is 12 bytes after a block of size 0 alloc'd
==15261==    at 0x4023BDE: calloc (vg_replace_malloc.c:397)
==15261==    by 0x80E3AF4: Stbl_reserveCellsInTable (TRSTable.c:983)
==15261==    by 0x80E506D: Stbl_addCellToTable (TRSTable.c:1482)
==15261==    by 0x806342A: HText_startStblTD (GridText.c:5007)
==15261==    by 0x80C13DC: HTML_start_element (HTML.c:5553)
==15261==    by 0x810DDF1: start_element (SGML.c:1306)
==15261==    by 0x8112B20: SGML_character (SGML.c:3485)
==15261==    by 0x811503B: SGML_write (SGML.c:4408)
==15261==    by 0x81204FE: HTFileCopy (HTFormat.c:925)
==15261==    by 0x8120FE6: HTParseFile (HTFormat.c:1455)
 
> Files lynx2-8-7/src/.TRSTable.c.swp and lynx2-8-7Y/src/.TRSTable.c.swp differ
> diff -Nur lynx2-8-7/src/TRSTable.c lynx2-8-7Y/src/TRSTable.c
> --- lynx2-8-7/src/TRSTable.c    2005-10-17 02:17:20.000000000 +0200
> +++ lynx2-8-7Y/src/TRSTable.c   2008-02-26 17:49:58.000000000 +0100
> @@ -957,6 +957,20 @@
>      int growby;
>      int i;
> 
> +    if (colspan > TRST_MAXCOLSPAN) {
> +       CTRACE2(TRACE_TRST,
> +                      (tfp,
> +                       "TRST:*** COLSPAN=%d is too large, ignored!\n",
> +                       colspan));
> +       return -1;
> +    }
> +    if (rowspan > TRST_MAXROWSPAN) {
> +       CTRACE2(TRACE_TRST,
> +                      (tfp,
> +                       "TRST:*** ROWSPAN=%d is too large, ignored!\n",
> +                       rowspan));
> +       return -1;
> +    }
>      if (me->nrows <= 0)
>         return -1;              /* must already have at least one row */
> 
> @@ -1223,7 +1237,7 @@
>      me->cells[me->ncells - 1].colspan : 1;
> 
>      if (ncolinfo == 0 || me->ncells + last_colspan > ncolinfo) {
> -       colspan = HTMAX(TRST_MAXCOLSPAN,
> +       colspan = HTMIN(TRST_MAXCOLSPAN, /* this have more sense to me */
>                         ncols_sofar - (me->ncells + last_colspan - 1));
>      } else {
>         for (i = me->ncells + last_colspan - 1; i < ncolinfo - 1; i++)
> @@ -1231,6 +1245,9 @@
>                 break;
>         colspan = i - (me->ncells + last_colspan - 2);
>      }
> +    CTRACE2(TRACE_TRST,
> +           (tfp, "TRST:get_remaining_colspan; colspan = %d\n",
> +            colspan));
>      return colspan;
>  }

-- 
Thomas E. Dickey <address@hidden>
http://invisible-island.net
ftp://invisible-island.net