- Dillo-dev - lists.mailman3.com

Patches for two use-after-free bugs
by Nopey Nope Jan. 25, 2026

Jan. 25, 2026

Hello! Find attached two patches, which each fix a use-after-free bug. I've also attached a crashing html document for each, but please be aware that these reproducer documents link urls from external web servers. The reproducers crash reliably on my x86_64 Void Linux laptop, but I've not tested them elsewhere. I've also attached a crash log with asan reporting of each. Thank you -Magnus L p.s. I've also opened github PR 449 with these same changes, but figured I should send the patches via email as well-- if only for practice :)

2 2

Segfault while running SSL Labs CurveBall test
by a1ex＠dismail.de Jan. 16, 2026

Jan. 16, 2026

Hi, I was running some tests from ssllabs.com and ran into a segfault. I used the "CurveBall" manual test link from this page: https://clienttest.ssllabs.com:8443/ssltest/viewMyClient.html Which points to: https://www.ssllabs.com:10446/ Nav_open_url: new url='https://www.ssllabs.com:10446/' Connecting to 69.67.183.100:10446 www.ssllabs.com:10446: TLSv1.2, cipher ECDHE-ECDSA-AES256-GCM-SHA384 ecdsa-with-SHA256 384-bit EC: /C=US/ST=California/L=Foster City/O=Qualys, Inc./OU=SSLLabs CurveBall Leaf/CN=www.ssllabs.com ecdsa-with-SHA256 Program received signal SIGSEGV, Segmentation fault. _lcry_EVP_PKEY_id (pkey=0x0) at /usr/src/lib/libcrypto/evp/p_lib.c:793 793 return pkey->type; (gdb) bt #0 _lcry_EVP_PKEY_id (pkey=0x0) at /usr/src/lib/libcrypto/evp/p_lib.c:793 #1 0x000001f9ee7da2b0 in Tls_check_cert_strength (ssl=<optimized out>, srv=<optimized out>, choice=0x6faff21f66f8) at tls_openssl.c:526 #2 0x000001f9ee7d8fd3 in Tls_examine_certificate (ssl=0x1fca8ddac80, srv=0x1fc1b4056a0) at tls_openssl.c:865 #3 Tls_connect (fd=7, connkey=4) at tls_openssl.c:1208 #4 0x000001fce9a7a7f0 in fl_wait(double) () from /usr/local/lib/libfltk.so.9.0 #5 0x000001fce9a0777f in Fl::wait(double) () from /usr/local/lib/libfltk.so.9.0 #6 0x000001fce9a079a1 in Fl::wait() () from /usr/local/lib/libfltk.so.9.0 #7 0x000001f9ee77e774 in main (argc=1, argv=0x6faff21f6a48) at dillo.cc:621 When I try to open it with curl, this is the result: curl: (35) TLS connect error: error:10FFF010:elliptic curve routines:CRYPTO_internal:EC lib This is on OpenBSD, using LibreSSL. I did a curl test on a Linux box and didn't get that error, so it may be LibreSSL specific. Happy to do further testing if you have any ideas. Regards, Alex

2 2

Avoid ctype(3) abuses
by Leonardo Taccari Jan. 16, 2026

Jan. 16, 2026

Hello! Most ctype(3) functions usage abuses an undefined behavior of passing values outside integers outside EOF or the range representable as unsigned char. On NetBSD 11 and newer such incorrect behaviors crashes applications violating that and due that Dillo easily crash by just visiting, e.g. <https://www.NetBSD.org/>. For possible further information please give a look to <https://man.NetBSD.org/ctype.3#CAVEATS>. I have grep-ed all such uses and added the relevant cast to uchar_t similar to other ctype(3) calls already present and in that way I can also confirm that Dillo no longer crashes. Attached in this email you can find a patch to address that. Thank you!

2 6

Segfault on form submit / CSS display:none
by Thomas Rudolph Jan. 15, 2026

Jan. 15, 2026

Hi, the following html code causes Dillo to segfault in the latest git versions when clicking the button. I stripped the html down to the problem: <form> <span style="display:none;"> <input type="checkbox" name="x"> </span> <input type=submit name="submit" value="Crash"> </form> This is reproducible on my Raspberry Pi OS (Debian 13) machine as well as on my laptop (Debian 13). Removing either "display:none;", or the name attribute of the input, or disabling embedded CSS results in Dillo not crashing. Input type text crashes as well as checkbox. Older versions of Dillo such as the 3.2.0 release do not crash on this code, too. Thanks for resurrecting this awesome browser. It has become my default browser for 60-70 percent of the web. All the best, Thomas

2 1

Include missing <stdlib.h> for calloc(3) and exit(3)
by Leonardo Taccari Jan. 12, 2026

Jan. 12, 2026

Hello! When trying to build current HEAD of dillo in NetBSD the build fails with: [...] g++ ... -o dialog.o dialog.cc [...] dialog.cc:38:1: note: 'calloc' is defined in header '<cstdlib>'; this is probably fixable by adding '#include <cstdlib>' 37 | #include "dlib/dlib.h" +++ |+#include <cstdlib> 38 | dialog.cc:192:11: error: 'exit' was not declared in this scope 192 | exit(1); | ^~~~ dialog.cc:192:11: note: 'exit' is defined in header '<cstdlib>'; this is probably fixable by adding '#include <cstdlib>' *** [dialog.o] Error code 1 [...] Including <stdlib.h> fixes that and the attached patch does that. Thank you!

2 2

Remote control socket (experimental)
by Rodrigo Arias Dec. 20, 2025

Dec. 20, 2025

Hi, I have just merged the support to control dillo from a UNIX control socket. There is now a new program called "dilloc" to send commands from the CLI. If there is only one dillo process it will choose it, otherwise it needs to be specified in the DILLO_PID env var. Use "dilloc help" to see all the commands available. It needs to be enabled at configure time with --enable-control-socket. The origin of this feature is to improve the test suite by controlling dillo automatically, but I think it will also be useful for users. In particular, the load and dump commands allow the manipulation of any loaded page as a UNIX pipeline: % dilloc dump | <manipulate-cmd> | dilloc load Or go to an alternative page from the current URL: % dilloc open $(dilloc url | sed 's/www\.reddit/old.reddit/') Let me know if you find something that doesn't work well, it is experimental for now. Best, Rodrigo.

3 11

CJK Fonts
by B Hiltz Dec. 15, 2025

Dec. 15, 2025

Hello, I think I have compiled something wrong on my end. When visiting sites with CJK fonts (e.g. https://www.unicode.org/standard/translations/japanese.html) none of the characters display (just empty blocks). Running v3.2.0-92-g527846a3 on Debian 13. Also, thank you for keeping Dillo going. I only use it once or twice a week but it is a great tool to have. Best regards, Bobby Hiltz

4 4

dillo.org get back
by Jesse Lawton Dec. 12, 2025

Dec. 12, 2025

Hi, I heard about what happened to dillo.org so tried to see if I could get it back. I contacted the registrar (Spaceship, I found out by whois), and they replied and I asked them to contact you to see what could be done and they said this: "Hello, Thank you for contacting us back! We are sorry for the inconvenience you have faced. Unfortunately, we won't be able to move the domain to your developer or make any changes to the domain if you are not its Registrant. If you act on behalf of the party interested in the domain name, then we suggest contacting the Registrant of the [1]dillo.org directly using the contact information specified in the public Whois: [2]https://www.spaceship.com/domains/whois/ You may contact the Registrant and discuss with them if they can move the domain to you or your developers. If you need any additional information, please do not hesitate to contact us. - Best regards, Spaceship Team" So it looks like if you contact them you might get it back! -- Thanks Jesse Lawton

2 5

[PATCH] Experimental FLTK 1.4.X support
by a1ex＠dismail.de Nov. 21, 2025

Nov. 21, 2025

Hi, Here is a patch to enable experimental FLTK 1.4.X support which adds a '--enable-fltk14' flag to 'configure'. By default we still use 1.3.X. This addresses bug #509: https://bug.dillo-browser.org/509/ --- a/configure.ac Tue Nov 11 13:06:16 2025 +++ b/configure.ac Fri Nov 21 10:48:50 2025 @@ -115,6 +115,11 @@ AC_ARG_ENABLE([brotli], [enable_brotli=$enableval], [enable_brotli=yes]) +AC_ARG_ENABLE([fltk14], + [AS_HELP_STRING([--enable-fltk14], [Enable FLTK 1.4.X (EXPERIMENTAL)])], + [enable_fltk14=$enableval], + [enable_fltk14=no]) + AC_ARG_WITH([ca-certs-file], [AS_HELP_STRING([--with-ca-certs-file=FILE], [Specify where to find a bundle of trusted CA certificates for TLS])], CA_CERTS_FILE=$withval) @@ -225,25 +230,39 @@ fi dnl ------------------------- -dnl Test for FLTK 1.3 library +dnl Test for FLTK library dnl ------------------------- dnl dnl For debugging and to be user friendly -AC_PATH_PROGS(FLTK_CONFIG,[fltk-config1.3 fltk-config]) -AC_MSG_CHECKING([FLTK 1.3]) +AC_PATH_PROGS(FLTK_CONFIG,[fltk-config1.3 fltk-config1.4 fltk-config]) fltk_version="`$FLTK_CONFIG --version 2>/dev/null`" -case $fltk_version in - 1.3.*) AC_MSG_RESULT(yes) +if test "x$enable_fltk14" = "xyes"; then + AC_MSG_CHECKING([FLTK 1.4.X]) + case $fltk_version in + 1.4.*) AC_MSG_RESULT(yes) LIBFLTK_CXXFLAGS=`$FLTK_CONFIG --cxxflags` LIBFLTK_CFLAGS=`$FLTK_CONFIG --cflags` LIBFLTK_LIBS=`$FLTK_CONFIG --ldflags`;; - 1.4.*) AC_MSG_RESULT(no) - AC_MSG_ERROR([FLTK $fltk_version not supported yet; use FLTK 1.3]);; ?*) AC_MSG_RESULT(no) - AC_MSG_ERROR(FLTK 1.3 required; version found: $fltk_version);; + AC_MSG_ERROR(FLTK 1.4.X required; version found: $fltk_version);; *) AC_MSG_RESULT(no) - AC_MSG_ERROR(FLTK 1.3 required; fltk-config not found) -esac + AC_MSG_ERROR(FLTK 1.4.X required; fltk-config not found) + esac +else + AC_MSG_CHECKING([FLTK 1.3]) + case $fltk_version in + 1.3.*) AC_MSG_RESULT(yes) + LIBFLTK_CXXFLAGS=`$FLTK_CONFIG --cxxflags` + LIBFLTK_CFLAGS=`$FLTK_CONFIG --cflags` + LIBFLTK_LIBS=`$FLTK_CONFIG --ldflags`;; + 1.4.*) AC_MSG_RESULT(no) + AC_MSG_ERROR([FLTK $fltk_version not supported yet; use FLTK 1.3]);; + ?*) AC_MSG_RESULT(no) + AC_MSG_ERROR(FLTK 1.3 required; version found: $fltk_version);; + *) AC_MSG_RESULT(no) + AC_MSG_ERROR(FLTK 1.3 required; fltk-config not found) + esac +fi dnl ----------------------------------- dnl Test for X11 (only on some systems) Regards, Alex

1 0

[PATCH] add new website to the about:spash page
by a1ex＠dismail.de Nov. 11, 2025

Nov. 11, 2025

Hi, a small patch in case you missed it :) --- a/src/IO/about.c Tue Nov 11 13:08:32 2025 +++ b/src/IO/about.c Tue Nov 11 13:10:19 2025 @@ -56,7 +56,7 @@ const char *const AboutSplash= "</ul>\n" "\n" "<p>See more details in the\n" -"<a href=\"https://dillo-browser.github.io/\">Dillo website</a>.</p>\n" +"<a href=\"https://dillo-browser.org/\">Dillo website</a>.</p>\n" "\n" "</div>\n" "</body>\n"

2 2