Bug#969393: WebKitGtk's UI process (WebKitWebProcess) crashes at contextRetrieveSurrounding when passing a long string to im-wayland.so

[Andres Gomez Garcia]

On Wed, 2020-09-02 at 13:04 +0200, Alberto Garcia wrote:
> Control: reassign -1 libgtk-3-0
> Control: retitle -1 Crash in GtkIMContextWayland when pasting text in WebKitGTK
> Control: tags -1 patch fixed-upstream
> Control: found -1 3.24.5-1
> Control: fixed -1 3.24.17-1
> 
> On Tue, Sep 01, 2020 at 10:05:08PM +0300, Andres Gomez wrote:
> 
> > WebKitGtk's UI process crashes at contextRetrieveSurrounding when
> > running GNOME-Shell on Wayland (don't know about the X' case).
> > 
> > From a quick look to the stack trace, it seems that the WK call
> > passes a extremely long string to im-wayland.so and it crashes when
> > calling glib/gmem.c
> 
> I had a look at the backtrace and the code, and it seems that GTK
> itself does proper sanitizing of the string length received from
> WebKit.
> 
> So I believe that it is this GTK bug:
> 
>    https://gitlab.gnome.org/GNOME/gtk/-/issues/2565
> 
> This was fixed in GTK 3.24.17 ("Fix a crash in the Wayland input
> method"), and here's the patch:
> 
>    https://gitlab.gnome.org/GNOME/gtk/-/commit/e5d23aaaaf352748e6411cfd399d4b741be9d478 
> 
> Can you confirm that this patch solves the problem?

I can confirm this patch solves the problem.

Thanks a lot, Berto!

> 
> Berto
-- 
============================
Andres Gomez
https://www.andresgomez.org
tanty at andresgomez dot org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20200902/23e7f046/attachment.sig>