Package: xchat
Version: 2.6.4-2
Severity: important
Whenever I or someone else try to paste binary contents into a channel,
xchat crashes. To reproduce, you can simply open a new terminal, cat a
jpeg or such, and try pasting some of that into xchat.
I've verified that the bug also appears in the just-released 2.6.6
upstream version, and am marking it as serious because it makes it
possible to crash xchat remotely (by using for example xchat gnome which
is not affected to send binary content to a channel).
Below you'll find a verbose backtrace from the 2.6.6 version. It might
well be that pango/gtk is to blame, I had debug symbols for those
installed too (and xchat was built with nostrip option locally)
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 805501184 (LWP 22448)]
PyFrame_New (tstate=0x0, code=0x30237720, globals=0x30266030, locals=0x0) at
../Objects/frameobject.c:540
540 ../Objects/frameobject.c: No such file or directory.
in ../Objects/frameobject.c
(gdb) bt full
#0 PyFrame_New (tstate=0x0, code=0x30237720, globals=0x30266030, locals=0x0)
at ../Objects/frameobject.c:540
back = <value optimized out>
f = <value optimized out>
builtins = <value optimized out>
extras = <value optimized out>
ncells = <value optimized out>
nfrees = <value optimized out>
#1 0x0ed98278 in PyEval_EvalCodeEx (co=0x30237720, globals=0x30266030,
locals=0xeb528, args=0x302b4474, argcount=2,
kws=0x0, kwcount=0, defs=0x302633d4, defcount=2, closure=0x0) at
../Python/ceval.c:2528
f = <value optimized out>
retval = (PyObject *) 0x0
fastlocals = <value optimized out>
freevars = <value optimized out>
tstate = (PyThreadState *) 0x0
x = <value optimized out>
u = <value optimized out>
#2 0x0ed32098 in function_call (func=0x30262fb0, arg=0x302b4468, kw=<value
optimized out>) at ../Objects/funcobject.c:548
result = <value optimized out>
argdefs = <value optimized out>
d = (PyObject **) 0x302633d4
k = <value optimized out>
nd = 2
#3 0x0ed0daac in PyObject_Call (func=0x0, arg=0x30237720, kw=0x30266030) at
../Objects/abstract.c:1795
---Type <return> to continue, or q <return> to quit---
result = (PyObject *) 0x0
call = (ternaryfunc) 0xeb528
#4 0x0ed91cbc in PyEval_CallObjectWithKeywords (func=0x30262fb0,
arg=0x302b4468, kw=0x0) at ../Python/ceval.c:3430
result = <value optimized out>
#5 0x0edb1178 in PyErr_Warn (category=<value optimized out>,
message=0x104f8890 "Error loading GPOS table 4097")
at ../Python/errors.c:621
args = (PyObject *) 0x302b4468
res = <value optimized out>
func = (PyObject *) 0x30262fb0
#6 0x0e751dac in initpango () from
/var/lib/python-support/python2.4/gtk-2.0/pango.so
No symbol table info available.
#7 0x0f22aa0c in g_logv () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#8 0x0f22ac0c in g_log () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#9 0x0fac7e30 in pango_ot_info_get_gpos () from /usr/lib/libpangoft2-1.0.so.0
No symbol table info available.
#10 0x0fac8014 in pango_ot_info_get_gsub () from /usr/lib/libpangoft2-1.0.so.0
No symbol table info available.
#11 0x0fac8b24 in pango_ot_info_find_script () from
/usr/lib/libpangoft2-1.0.so.0
No symbol table info available.
#12 0x0ee79618 in script_engine_init () from
/usr/lib/pango/1.5.0/modules/pango-basic-fc.so
No symbol table info available.
---Type <return> to continue, or q <return> to quit---
#13 0x0f97ad58 in pango_coverage_new () from /usr/lib/libpango-1.0.so.0
No symbol table info available.
#14 0x0f98e494 in pango_shape () from /usr/lib/libpango-1.0.so.0
No symbol table info available.
#15 0x0f97ff04 in pango_layout_set_width () from /usr/lib/libpango-1.0.so.0
No symbol table info available.
#16 0x0f9834c4 in pango_layout_iter_get_char_extents () from
/usr/lib/libpango-1.0.so.0
No symbol table info available.
#17 0x0f983968 in pango_layout_iter_get_char_extents () from
/usr/lib/libpango-1.0.so.0
No symbol table info available.
#18 0x0f985d2c in pango_layout_get_lines () from /usr/lib/libpango-1.0.so.0
No symbol table info available.
#19 0x0fd4d0f4 in gtk_entry_adjust_scroll (entry=0x10107ad0) at gtkentry.c:3427
priv = (GtkEntryPrivate *) 0x10107b68
min_offset = <value optimized out>
max_offset = <value optimized out>
text_area_width = 734
text_width = <value optimized out>
strong_x = <value optimized out>
weak_x = <value optimized out>
strong_xoffset = <value optimized out>
weak_xoffset = <value optimized out>
xalign = <value optimized out>
---Type <return> to continue, or q <return> to quit---
logical_rect = {x = 267350812, y = 268362384, width = 269514832, height
= 2143613872}
#20 0x0fd4dbe8 in recompute_idle_func (data=0x10107ad0) at gtkentry.c:2906
entry = (GtkEntry *) 0x0
#21 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#22 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#23 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#24 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#25 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#26 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#27 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#28 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#29 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#30 0x0f21df4c in g_list_remove_link () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
Previous frame inner to this frame (corrupt stack?)
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
