Public bug reported:
While trying to render certain .doc files (which I can't share) with
wvHtml, I found it would segfault after what appears to be the entire
file contents have rendered.
I had basically no expertise in stuff less memory-safe than safe Rust
before this, so I'm going to give everything I turned up which I think
might be helpful in the ~6 hours I spent on this
Here's what `bt full` from gdb says on the package version:
#0 0x00007ffff7f21767 in wvGetIntervalBounds () at
/lib/x86_64-linux-gnu/libwv-1.2.so.4
#1 0x00007ffff7f2901e in wvGetSimpleParaBounds () at
/lib/x86_64-linux-gnu/libwv-1.2.so.4
#2 0x00007ffff7f2b003 in wvDecodeSimple () at
/lib/x86_64-linux-gnu/libwv-1.2.so.4
#3 0x00007ffff7f30847 in wvHtml () at /lib/x86_64-linux-gnu/libwv-1.2.so.4
#4 0x000055555555703a in ??? ()
I then made a local build from `wv_1.2.9.orig.tar.gz` off
packages.ubuntu.com with Firejail ensuring it wouldn't accidentally load
the system libwv and replicated the segfault using the CFLAGS="-g
-DDEBUG=1" from upstream's instructions.
However, I then discovered that the segfault is fragile enough that it
would readily stop happening until I threw away the entire Firejail
`--private=$PWD/temp` (just deleting the --prefix and the unpacked
tarball contents wasn't enough) so I whipped up a shell script to delete
and rebuild each time for consistency.
According to gdb, the segfaulting line is `*fcFirst = wvNormFC
(rgfc[nopos - 2], NULL);` at decode_simple.c:758
Since nothing looks null, my next hypothesis was that it was trying to
dereference some random un-initialized value.
Switching to CFLAGS="-O0 -g3 -DDEBUG=1" and valgrind revealed a flood of
some "Conditional jump or move depends on uninitialised value(s)", to
the point where valgrind decides to stop reporting them before running
out. The ones it does report have this general shape:
==10== Conditional jump or move depends on uninitialised value(s)
==10== at 0x4883975: wvMalloc (generic.c:79)
==10== by 0x4893CF1: wvGetPAPX_FKP (fkp.c:124)
==10== by 0x48912BB: wvGetSimpleParaBounds (decode_simple.c:678)
==10== by 0x4890137: wvDecodeSimple (decode_simple.c:398)
==10== by 0x489C0FC: wvHtml (wvHtmlEngine.c:34)
==10== by 0x10BB4C: main (wvWare.c:489)
==10== Uninitialised value was created by a stack allocation
==10== at 0x486B2E0: ??? (in /home/ssokolow/wv_build/lib/libwv-1.2.so.4.0.5)
However, skipping past those reveals this one associated with the
segfault:
==10== Process terminating with default action of signal 11 (SIGSEGV)
==10== Access not within mapped region at address 0x41BB55C9C
==10== at 0x4891746: wvGetIntervalBounds (decode_simple.c:758)
==10== by 0x48912EC: wvGetSimpleParaBounds (decode_simple.c:683)
==10== by 0x4890101: wvDecodeSimple (decode_simple.c:398)
==10== by 0x489C055: wvHtml (wvHtmlEngine.c:34)
==10== by 0x10BB4C: main (wvWare.c:489)
While the numbers are a couple of lines off, that does appear to be
close enough to probably be the same `*fcFirst = wvNormFC (rgfc[i],
NULL);` line.
As far as I can tell, this is likely either a mistake further up the
call stack, or a failure to validate the input, causing the parser to
attempt to read an offset outside the file and I'm at my limit for
diagnosing this further since the occasional successful runs I observed
could still come from either uninitialized memory getting into it
further up the call stack or variation in the memory layout preventing a
consistent bad dereference from resulting in a segfault.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: libwv-1.2-4t64 1.2.9-8
ProcVersionSignature: Ubuntu 6.8.0-134.134-generic 6.8.12
Uname: Linux 6.8.0-134-generic x86_64
NonfreeKernelModules: zfs
ApportVersion: 2.28.2-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Fri Jul 31 20:33:56 2026
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: wv
UpgradeStatus: Upgraded to noble on 2025-04-17 (470 days ago)
** Affects: wv (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162613
Title:
Segfault on certain input files
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/wv/+bug/2162613/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
