bugGNU Wget - Bugs: bug #54126, Wget keeps crashing in Windows...


bug #54126: Wget keeps crashing in Windows sometimes when the filename is large enough to scroll it

Submitted by:  Vyacheslav <vyacheslav>
Submitted on:  Sat 16 Jun 2018 10:43:59 PM UTC  
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  5 - Normal Status:  None
Privacy:  Public Assigned to:  Darshit Shah <darnir>
Originator Name:  Open/Closed:  Open
Release:  1.19.5 Operating System:  Microsoft Windows
Reproducibility:  Intermittent Fixed Release:  None
Planned Release:  1.21 Regression:  None
Work Required:  None Patch Included:  Yes

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Fri 05 Jul 2019 10:18:14 PM UTC, comment #2: 

comment #1:

> Seems like this only occurs under Windows, which makes it slightly problematic when reproducing.

in the function cols_to_byte() we see

while (p_cols <cols && _mbi_avail_ _(iter) ) {
if (p_cols> cols)
p_cols - = mb_width (mbc);

when USE_NLS_PROGRESS_BAR is undefined
cols_to_byte returns cols regardless length of the remainder of the string  (mbi_avail (iter))
This is the reason for repeating the last letter.
I think crash and freezes hapends in create_image ()

offset_bytes   =    cols_to_bytes(bp->f_download,
bytes_in_filename = cols_to_bytes(bp-> f_download + offset_bytes,
                                  MAX_FILENAME_COLS - padding,
//here we can read after the end of the string
memcpy (p, bp-> f_download + offset_bytes, bytes_in_filename);
p + = bytes_in_filename;
padding = MAX_FILENAME_COLS - (padding + * cols_ret);
// padding can be negative_
//            (size_t) -3 ???
memset (p, '', padding + 1);
p + = padding + 1;

debug build is free from crashes.
anyway after applying

-  *ncols = cols;
-  return cols;
+  int len = strlen(mbs);
+  int ret = (len < cols ? len : cols);
+  *ncols = ret;
+  return ret;

crashes disapieres
but unsure about japanese, korean, chinese

Mon 12 Nov 2018 10:25:05 PM UTC, comment #1: 

Thanks for the report! I'll take a look at the issue and see if I can spot any problems. Seems like this only occurs under Windows, which makes it slightly problematic when reproducing.

Darshit Shah <darnir>
Project AdministratorIn charge of this item.
Sat 16 Jun 2018 10:43:59 PM UTC, original submission:  

the last letter keeps getting repeated, while the rest of the progress bar stops updating.

I'm not very familiar with the Debuggers under Wine, so I'm just
added some code to progress.c, which writes to the logfile information about the function calls
and the values of the variables in this functions:
wne-console ./wget-deb.exe http://xxx.yyy.zz -O 01234567890123456789abcdef.iso


        //offset_bytes = cols_to_bytes (bp->f_download, offset_cols, cols_ret);
        >-cols_to_bytes(mbs=01234567890123456789abcdef.iso, cols=13)
              return 13
        <-cols_to_bytes (mbs=01234567890123456789abcdef.iso)
        offset_bytes = 13
        >-cols_to_bytes (mbs=3456789abcdef.iso, cols=19)
              return 19
        <-cols_to_bytes (mbs=3456789abcdef.iso)
        bytes_in_filename = 19 !!!!! BUT it is not!
        cols_ret = 19
        //memcpy (p, bp->f_download + offset_bytes, bytes_in_filename);
        #buffer/start=offset(13)/#         = #3456789abcdef.iso#
        padding = 0 => MAX_FILENAME_COLS - (padding + *cols_ret) [ 19 - (0 + 19)]   !!!!!! BUT must be real cols_bytes for padding!!
        space set at *p !!!!! always be at same place!
        #buffer/start=offset/padded/#      = #3456789abcdef.iso# !!!! must be #3456789abcdef.iso #!
And again and again.  cols_to_bytes() simply returns cols , regardless length of the string.
I think that sometimes memcpy goes beyond the boundaries of the memory belonging to the process,
depending on the length of the string and the memory allocation for it.

some changes in cols_to_bytes() and freezes disappear, no crashes for now yet.

Vyacheslav <vyacheslav>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #44378:  wget-patch.tar.xz added by vyacheslav (4KiB - application/x-xz - all patches that used in my build)
file #44376:  wget-version.txt added by vyacheslav (2KiB - text/plain)
file #44377:  progress-win32.patch added by vyacheslav (384B - text/x-patch)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by vyacheslav (Submitted the item)
  • -email is unavailable- added by vyacheslav



    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-11-12 darnir Assigned toNone => darnir
        Planned ReleaseNone => 1.21
    2018-06-16 vyacheslav Attached File- => Added wget-patch.tar.xz, #44378
    2018-06-16 vyacheslav Attached File- => Added wget-version.txt, #44376
        Attached File- => Added progress-win32.patch, #44377
        Carbon-Copy- => Added vyacheslav

    Back to the top

    Powered by Savane 3.5