[Bug]: HighlightRects segfault

[kgermakop]

Is there an existing issue for this?

• I have searched the existing issues

Problem

DBus method HighlightRects throws segmentation fault.

(The problem disappears after commenting out the loop starting at line 249 in dbus-interface.c (release version 0.5.11).)

Steps to reproduce

Call DBus method HighlightRects.

Expected behavior

Not throwing sefault.

zathura version (zathura --version)

0.5.11

girara version (zathura --version)

0.4.5

zathura backend

pdf-mupdf (0.4.4)

[sebastinas]

Please provide a backtrace of the crash.

[kgermakop]

This is the output of valgrind:

Invalid read of size 8
at 0x497FB29: girara_list_size (datastructures.c:275)
by 0x140F63: zathura_page_widget_draw (page-widget.c:691)
by 0x4CDF9E9: gtk_widget_draw_internal (gtkwidget.c:7084)
by 0x4A8EB01: gtk_container_propagate_draw (gtkcontainer.c:3854)
by 0x4A8EC2C: gtk_container_draw (gtkcontainer.c:3674)
by 0x4B31610: gtk_grid_render (gtkgrid.c:1711)
by 0x4A8F664: gtk_css_custom_gadget_draw (gtkcsscustomgadget.c:159)
by 0x4AA4749: gtk_css_gadget_draw (gtkcssgadget.c:885)
by 0x4B31F54: gtk_grid_draw (gtkgrid.c:1717)
by 0x4CDF9E9: gtk_widget_draw_internal (gtkwidget.c:7084)
by 0x4A8EB01: gtk_container_propagate_draw (gtkcontainer.c:3854)
by 0x4A8EC2C: gtk_container_draw (gtkcontainer.c:3674)

Address 0x25869448 is 8 bytes inside a block of size 32 free'd
at 0x48478EF: free (vg_replace_malloc.c:989)
by 0x118133: synctex_highlight_rects_impl (dbus-interface.c:250)
by 0x516DABF: gdk_threads_dispatch (gdk.c:769)
by 0x566A558: g_main_dispatch.lto_priv.0 (gmain.c:3357)
by 0x56CD256: UnknownInlinedFun (gmain.c:4208)
by 0x56CD256: g_main_context_iterate_unlocked.isra.0 (gmain.c:4273)
by 0x566B286: g_main_loop_run (gmain.c:4475)
by 0x4B79EBE: gtk_main (gtkmain.c:1329)
by 0x1174B7: main (main.c:297)

Block was alloc'd at
at 0x484BC13: calloc (vg_replace_malloc.c:1675)
by 0x497F16A: girara_list_new_with_free (datastructures.c:36)
by 0x118363: handle_highlight_rects (dbus-interface.c:294)
by 0x118C43: handle_method_call (dbus-interface.c:466)
by 0x54E5ED1: call_in_idle_cb.lto_priv.2 (gdbusconnection.c:5458)
by 0x566A558: g_main_dispatch.lto_priv.0 (gmain.c:3357)
by 0x56CD256: UnknownInlinedFun (gmain.c:4208)
by 0x56CD256: g_main_context_iterate_unlocked.isra.0 (gmain.c:4273)
by 0x566B286: g_main_loop_run (gmain.c:4475)
by 0x4B79EBE: gtk_main (gtkmain.c:1329)
by 0x1174B7: main (main.c:297)