Re: lynx-dev 2.8.2rel.1 crash

[Klaus Weide]

On Mon, 26 Jul 1999, T.E.Dickey wrote:

> > 
> > On Mon, 26 Jul 1999, Andrew Pimlott wrote: 
> >  
> > > % lynx http://www.itso.iu.edu/alerts/ 
> > >  
> > > A Fatal error has occurred in Lynx Ver. 2.8.2rel.1 
> >  
> > I can confirm this with 2.8.2dev.19 on SunOS 4.1.3_U1. I downloaded 
> 
> 2.8.3dev.3 works fine (there was a usemap fix - again - a few patches ago).

Did you mean 2.8.3dev.4?

It still crashes for me.  My HTML.c is basically 2.8.3dev.3 with some
changes for my 'simple table' stuff.  I didn't compile 2.8.3dev.4 yet,
but compared the 2.8.3dev.4 HTML.c with mine.  The only relevant
difference I found (there is also some change in MakeNewTitle that is
#ifdef SH_EX and shouldn't be relevant here) is in MakeNewMapValue:

my (2.8.3dev.3) HTML.c:

    StrAllocCat(newtitle,mapstr); /* ISMAP or USEMAP */
    if ( verbose_img ) {

2.8.3dev.4 HTML.c:

    StrAllocCat(newtitle,mapstr); /* ISMAP or USEMAP */
    if ( verbose_img && value[HTML_IMG_SRC] && *value[HTML_IMG_SRC] ) {

This would indeed add some protection for the case of <IMG SRC>
(i.e. SRC attribute without value), so 2.8.3dev.4 shouldn't crash
where 2.8.3dev.3 could.  But the protection isn't really enough -
value[HTML_IMG_SRC] could still be a string left over in the value[]
array from some other invocation of HTML_start_element, it is only
valid to refer to value[HTML_IMG_SRC] if present[HTML_IMG_SRC] is
true.  In other words, value[HTML_IMG_SRC] could be non-NULL but point
to an arbitrary string or (maybe?) to invalid memory.  The clean
solution would be to also pass 'present' to MakeNewMapValue and check
it there, or check for 'present[HTML_IMG_SRC]' before calling
MakeNewMapValue.  But:

There is something else bogus in the use of this function.  In three
places it is called as MakeNewMapValue(value,"USEMAP").  Apparently we
want to output some "verbose" information on the USEMAP attribute
value, but MakeNewMapValue will instead try to use information from
the SRC attribute value.  (a) It might make more sense to show
information on the USEMAP attribute instead of the SRC attribute (but
that's for attentive users of VERBOSE_IMAGES to decide); but (b) the
information may be bogus/invalid if SRC was completely absent, see
previous paragraph, and will be empty if SRC was present but had no
value, as is the case in the URL in question
(<http://www.itso.iu.edu/alerts/>).

   Klaus