Bug 20036

Summary:	Gtk3 textview application breaks if it contains invisible text and uses pixel_below_lines > 1
Product:	Mageia	Reporter:	Juergen Harms <juergen.harms>
Component:	RPM Packages	Assignee:	All Packagers <pkg-bugs>
Status:	NEW ---	QA Contact:
Severity:	normal
Priority:	Normal	CC:	juergen.harms, marja11, olav
Version:	Cauldron
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA5TOO
Source RPM:	gtk+3.0-3.22.5-1.mga6	CVE:
Status comment:
Attachments:	Test demo application that illustrates the problem

Description Juergen Harms 2016-12-28 12:27:51 CET

Description of problem:

Gtk3 applications with a textview panel break if there is a combination of
  - text with zones that have an "invisible" text-tag,
  - the textview panel uses the "pixel_below_lines" property with a value >= 2
  - the cursor enters a line of the textview panel that contains invisible text

A short demo-application is joined as an attachment - this demo is a reduction and port to C of a largish Gtk3/perl application.

Due to reducing it to a minimum-size demo, this reduction may appear weird - the original application uses invisible text to shorten excessively long lines, but nevertheless keep them searchable / retrievable (and please excuse if the C implementation is clumsy, my C skills have become rusty).


Version-Release number of selected component (if applicable):


How reproducible: always

Steps to Reproduce:
1. compile / run the code of the attached demo
2. move the pointer across the text in the textview panel
3. when the pointer enters a line that also contains invisible text, the
   application will immediately abort.

Notes:
 - I have tried with Mageia-5 (gtk+3.0-3.14.8-5.1.mga5) : same problem
 - with a value of 1 for pixels_below_lines : no problem
 - any value of pixels_above_lines : no problem
 - I do not know whether this is essential for the bug to strike: the zone
   with invisible text in the demo are near the end of the concerned lines.
 - fully updated cauldron (resp. Mageia-5) on 64-bit machines, Xfce desktop

The bug may look far-fetched, but using invisible text and below-line spacing
is not extravagant - and the bug is nasty, because the application simply blows
up and it is quite hard to attribute such a crash to its specific cause.

Comment 1 Juergen Harms 2016-12-28 12:29:17 CET

Created attachment 8821 [details]
Test demo application that illustrates the problem

CC: (none) => juergen.harms

Comment 2 Juergen Harms 2016-12-28 14:36:05 CET

In the description, I forgot to add the error message that is issued when you launch the demo application from a command-line and the application blows up, sorry. And where am I supposed to find the core dump?

(demo:30090): Gtk-WARNING **: gtktextbtree.c:4041: byte index off the end of the line

(demo:30090): Gtk-ERROR **: Byte index 44 is off the end of the line
Trace/BPT trap (core dumped)

Comment 3 Marja Van Waes 2016-12-30 09:37:30 CET

Assigning to all packagers collectively, since there is no registered maintainer for this package.

CC: (none) => marja11, olav
Assignee: bugsquad => pkg-bugs
Source RPM: gtk+3.0-3.22.5-1.mga6.src.rpm => gtk+3.0-3.22.5-1.mga6
Whiteboard: (none) => MGA5TOO

Comment 4 Olav Vitters 2017-01-02 20:45:55 CET

Is this specific to Mageia somehow? I'd suggest filing a bugreport with upstream, see https://bugzilla.gnome.org/. We carry almost no patches for gtk+3.x