https://bugzilla.redhat.com/show_bug.cgi?id=1100974 Yohei Yukawa <yukawa(a)google.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bug(a)funcy.com, | |yukawa(a)google.com Flags| |needinfo?(bug(a)funcy.com) --- Comment #11 from Yohei Yukawa <yukawa(a)google.com&gt; --- Hi LovelyTivoli, I'm interested in the way how to reproduce this issue. I couldn't reproduce this issue on Fedora 20. Can you elaborate a bit more about the detailed steps to reproduce this issue? BTW, your attachment 898952 seems to be explaining what is going on. https://bugzilla.redhat.com/attachment.cgi?id=898952 #6 0x0000003c55cb3aa7 in std::__throw_out_of_range (__s=__s@entry=0x48f776 "basic_string::substr") at ../../../../../libstdc++-v3/src/c++11/functexcept.cc:80 No locals. #7 0x00000000004129a5 in _M_check (__s=0x48f776 "basic_string::substr", __pos=18, this=0x7fffe7c2fe70) at /usr/include/c++/4.8.2/bits/basic_string.h:324 No locals. #8 substr (__n=18446744073709551615, __pos=18, this=0x7fffe7c2fe70) at /usr/include/c++/4.8.2/bits/basic_string.h:2208 No locals. #9 mozc::ibus::(anonymous namespace)::GetSurroundingText (engine=engine@entry=0x213f2a0, selection_monitor=<optimized out>, info=info@entry=0x7fffe7c2ff40) at unix/ibus/mozc_engine.cc:233 anchor_pos = 0 surrounding_text = "/var/log/messages" cursor_pos = 18 text = 0x7f200c006580 selection_length = 18 And here is the corresponding code in Mozc. https://code.google.com/p/mozc/source/browse/trunk/src/unix/ibus/mozc_eng... bool GetSurroundingText(IBusEngine *engine, #ifdef MOZC_ENABLE_X11_SELECTION_MONITOR SelectionMonitorInterface *selection_monitor, #endif // MOZC_ENABLE_X11_SELECTION_MONITOR SurroundingTextInfo *info) { if (!(engine->client_capabilities & IBUS_CAP_SURROUNDING_TEXT)) { VLOG(1) << "Give up CONVERT_REVERSE due to client_capabilities: " << engine->client_capabilities; return false; } guint cursor_pos = 0; guint anchor_pos = 0; // DO NOT call g_object_unref against this. // http://ibus.googlecode.com/svn/docs/ibus-1.4/IBusText.html // http://developer.gnome.org/gobject/stable/gobject-The-Base-Object-Type.ht... IBusText *text = NULL; ibus_engine_get_surrounding_text(engine, &text, &cursor_pos, &anchor_pos); const string surrounding_text(ibus_text_get_text(text)); #ifdef MOZC_ENABLE_X11_SELECTION_MONITOR if (cursor_pos == anchor_pos && selection_monitor != NULL) { const SelectionInfo &info = selection_monitor->GetSelectionInfo(); guint new_anchor_pos = 0; if (SurroundingTextUtil::GetAnchorPosFromSelection( surrounding_text, info.selected_text, cursor_pos, &new_anchor_pos)) { anchor_pos = new_anchor_pos; } } #endif // MOZC_ENABLE_X11_SELECTION_MONITOR if (!SurroundingTextUtil::GetSafeDelta(cursor_pos, anchor_pos, &info->relative_selected_length)) { LOG(ERROR) << "Too long text selection."; return false; } const uint32 selection_start = min(cursor_pos, anchor_pos); const uint32 selection_length = abs(info->relative_selected_length); info->preceding_text = surrounding_text.substr(0, selection_start); // <---- Crash Here Util::SubString(surrounding_text, selection_start, selection_length, &info->selection_text); info->following_text = surrounding_text.substr( selection_start + selection_length); return true; } What I can tell from your crash log (attachment 898952) is that ibus_engine_get_surrounding_text returned the following values: - text: "/var/log/messages" - cursor_pos: 18 - anchor_pos: (probably) 0 This is problematic because cursor_pos is out of the range of the returned text "/var/log/messages", which consists of 17 characters only. I'm not sure why IBus returns this sort of invalid values but my takeaways are: a. (If my assumption is true), IBus should have had some range checking for ibus_engine_get_surrounding_text. b. (If my assumption is true), ibus-mozc should not have assumed that IBus always returns valid data. As for b., a possible workaround is to make sure cursor_pos and anchor_pos do not point outside of surrounding_text as follows: ibus_engine_get_surrounding_text(engine, &text, &cursor_pos, &anchor_pos); - const string surrounding_text(ibus_text_get_text(text)); + const gchar *text_ptr = ibus_text_get_text(text); + const string surrounding_text(text_ptr != nullptr ? text_ptr : ""); + cursor_pos = min(cursor_pos, surrounding_text.size()); + anchor_pos = min(anchor_pos, surrounding_text.size()); Anyway, it would be nice if reliable reproducible steps is provided so that I can test this on my local environment, or you can rebuild ibus-mozc with above change to check whether the crash disappears or not. Thanks. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0Tzrnm2M2t&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1100974 --- Comment #13 from Akira TAGOH <tagoh(a)redhat.com&gt; --- (In reply to Yohei Yukawa from comment #12) No such releases has been made in public or at least I can't find it out in the download page though, any plans to make a new release? -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=zDIWMo6wjv&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1100974 Akira TAGOH <tagoh(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #15 from Akira TAGOH <tagoh(a)redhat.com&gt; --- Thanks. building new version then. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=mbeDflxmhf&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1100974 --- Comment #16 from Fedora Update System <updates(a)fedoraproject.org&gt; --- mozc-1.15.1814.102-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/mozc-1.15.1814.102-1.fc20 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VVTtq3gtp8&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1100974 Fedora Update System <updates(a)fedoraproject.org&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |ON_QA --- Comment #18 from Fedora Update System <updates(a)fedoraproject.org&gt; --- Package mozc-1.15.1814.102-1.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing mozc-1.15.1814.102-1.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-7813/mozc-1.15.1814.1... then log in and leave karma (feedback). -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=wOBO7i3IMc&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1100974 Fedora Update System <updates(a)fedoraproject.org&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|mozc-1.15.1814.102-1.fc19 |mozc-1.15.1814.102-1.fc20 --- Comment #20 from Fedora Update System <updates(a)fedoraproject.org&gt; --- mozc-1.15.1814.102-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=tzZODNEG8Q&a=cc_unsubscribe