Bug#969393: WebKitGtk's UI process (WebKitWebProcess) crashes at contextRetrieveSurrounding when passing a long string to im-wayland.so

[Alberto Garcia]

Control: reassign -1 libgtk-3-0
Control: retitle -1 Crash in GtkIMContextWayland when pasting text in WebKitGTK
Control: tags -1 patch fixed-upstream
Control: found -1 3.24.5-1
Control: fixed -1 3.24.17-1

On Tue, Sep 01, 2020 at 10:05:08PM +0300, Andres Gomez wrote:

> WebKitGtk's UI process crashes at contextRetrieveSurrounding when
> running GNOME-Shell on Wayland (don't know about the X' case).
> 
> From a quick look to the stack trace, it seems that the WK call
> passes a extremely long string to im-wayland.so and it crashes when
> calling glib/gmem.c

I had a look at the backtrace and the code, and it seems that GTK
itself does proper sanitizing of the string length received from
WebKit.

So I believe that it is this GTK bug:

   https://gitlab.gnome.org/GNOME/gtk/-/issues/2565

This was fixed in GTK 3.24.17 ("Fix a crash in the Wayland input
method"), and here's the patch:

   https://gitlab.gnome.org/GNOME/gtk/-/commit/e5d23aaaaf352748e6411cfd399d4b741be9d478 

Can you confirm that this patch solves the problem?

Berto