Nathan J. Yoder wrote:
>> Please fix this soon,
>>
>> ***COMMAND***
>> wget -k http://reality.sgi.com/fxgovers_houst/yama/panels/panelsIntro.html
>[snip]
>> 02:30:05 (23.54 KB/s) - `panelsIntro.html' saved [3061/3061]
>>
>> Converting panelsIntro.html... zsh: segmentation fault (core dumped)
Ian Abbott replied:
> I cannot reproduce this failure on my RedHat 7.1 box.
I was able to reproduce this pretty easily on both Irix 6.5.2 and Digital
Unix 4.0d, using gcc 2.95.2. (I bet Linux's glibc has code to protect against
fwrite() calls with negative lengths.)
The problem occurs when you have a single tag with multiple attributes that
specify links that need to be converted. In this case, it's an IMG tag with
SRC and LOWSRC attributes. The urlpos structure passed to convert_links() is
a linked list of pointers to where the links are that needed to be converted.
The problem is that the links are not in positional order. The second
attribute is in the linked list before the first attribute, causing the
length of the string to be printed out to be a negative number.
Here's a diff (against the current CVS sources) which will prevent the core
dump, but please note that it does not fix the problem. html-parse.c and
html-url.c are some dense code, and I'm still wading through it. (Also, it's
not clear if the linked list is supposed to be in positional order or if
convert_links() is wrongly assuming that.)
Index: url.c
===================================================================
RCS file: /pack/anoncvs/wget/src/url.c,v
retrieving revision 1.46
diff -u -r1.46 url.c
--- url.c 2001/06/18 09:08:04 1.46
+++ url.c 2001/08/23 17:07:10
@@ -1442,6 +1442,11 @@
/* Echo the file contents, up to the offending URL's opening
quote, to the outfile. */
+ if (url_start - p < 0)
+ {
+ DEBUGP (("URLs are out of order! Please investigate."));
+ break;
+ }
fwrite (p, 1, url_start - p, fp);
p = url_start;
if (l->convert == CO_CONVERT_TO_RELATIVE)
