- Dillo-dev - lists.mailman3.com

Re: [PATCH] Use FL_FOREGROUND_COLOR for widget selection color

by Rodrigo Arias

Hi, On Fri, Feb 20, 2026 at 01:14:33PM +0000, a1ex(a)dismail.de wrote: >Hi, > >Currently Dillo uses a fixed color (black) for the widget selection >color, which includes checkmarks and radio buttons. When using a dark >color scheme, these selections can be invisible or hard to see. Instead, >use the foreground color from dillorc to ensure visibility. > >Patch is attached. Thanks!, merged. >Also, I put up a little blog post with some other Dillo patches, >hopefully someone here will find it interesting! I welcome any feedback. >https://alex.envs.net/blog/dillo Cool! Best, Rodrigo.

Feb. 20, 2026

[PATCH] Use FL_FOREGROUND_COLOR for widget selection color

by a1ex＠dismail.de

Hi, Currently Dillo uses a fixed color (black) for the widget selection color, which includes checkmarks and radio buttons. When using a dark color scheme, these selections can be invisible or hard to see. Instead, use the foreground color from dillorc to ensure visibility. Patch is attached. Also, I put up a little blog post with some other Dillo patches, hopefully someone here will find it interesting! I welcome any feedback. https://alex.envs.net/blog/dillo Regards, Alex

Feb. 20, 2026

Re: Patches for two use-after-free bugs

by Rodrigo Arias

Hi, >I will test it a bit with ASan enabled and merge it if nothing breaks. Merged in 9562d30a: https://git.dillo-browser.org/dillo/log/ Best, Rodrigo.

Feb. 1, 2026

Re: Patches for two use-after-free bugs

by Rodrigo Arias

Hi Magnus, On Sun, Jan 25, 2026 at 11:53:08AM -0700, Nopey Nope wrote: >Thanks for the guidance, Rodrigo! > >Had a better idea on how to fix the socketdata use-after-free; new >attached patch 0002 fixes the bug by only freeing the queued sockdata >if it's exclusively owned by the server queue. > >I've added information in the commit summaries as suggested. > >I also added an assert in Http_socket_enqueue, which makes explicit >the precondition that socketdata can only be queued to one server at a >time. >This assert has not tripped, and hopefully never will; I thought it >helped illustrate the relation between servers and socketdatas. Thanks a lot!, they both look good. I'll leave the assert in Http_socket_enqueue but remove the message string as it causes a warning in gcc and I don't think is needed for this case. https://git.dillo-browser.org/dillo/log/?h=fix-uaf I will test it a bit with ASan enabled and merge it if nothing breaks. Best, Rodrigo.

Jan. 31, 2026

Re: Patches for two use-after-free bugs

by Nopey Nope

Thanks for the guidance, Rodrigo! Had a better idea on how to fix the socketdata use-after-free; new attached patch 0002 fixes the bug by only freeing the queued sockdata if it's exclusively owned by the server queue. I've added information in the commit summaries as suggested. I also added an assert in Http_socket_enqueue, which makes explicit the precondition that socketdata can only be queued to one server at a time. This assert has not tripped, and hopefully never will; I thought it helped illustrate the relation between servers and socketdatas. Magnus On Sat, Jan 24, 2026 at 2:10 PM Rodrigo Arias <rodarima(a)gmail.com> wrote: > > Hi Magnus, > > On Sat, Jan 24, 2026 at 11:13:25AM -0800, Nopey Nope wrote: > >Hello! > > > >Find attached two patches, which each fix a use-after-free bug. > > > >I've also attached a crashing html document for each, but please be > >aware that these reproducer documents link urls from external web > >servers. > >The reproducers crash reliably on my x86_64 Void Linux laptop, but > >I've not tested them elsewhere. I've also attached a crash log with > >asan reporting of each. > > > >Thank you > >-Magnus L > > > >p.s. I've also opened github PR 449 with these same changes, but > >figured I should send the patches via email as well-- if only for > >practice :) > > Thanks a lot for the patches and reproducers! > > I saw the PR but I only had time to look at the "Fix use-after-free in > openssl cert popup" commit which seems good. We are moving away from > GitHub so it would be nice to send future patches here (or a link to a > git repo/branch to fetch with git). > > It would help to describe what is the condition that triggers the UAF in > the Http_server patch and why the change helps, so that it is easier to > review. > > Perhaps it would be a good idea to put that information it in the commit > summary of both patches so we can see it via git blame. > > Best, > Rodrigo. > _______________________________________________ > Dillo-dev mailing list -- dillo-dev(a)mailman3.com > To unsubscribe send an email to dillo-dev-leave(a)mailman3.com

Jan. 25, 2026

Re: Patches for two use-after-free bugs

by Rodrigo Arias

Hi Magnus, On Sat, Jan 24, 2026 at 11:13:25AM -0800, Nopey Nope wrote: >Hello! > >Find attached two patches, which each fix a use-after-free bug. > >I've also attached a crashing html document for each, but please be >aware that these reproducer documents link urls from external web >servers. >The reproducers crash reliably on my x86_64 Void Linux laptop, but >I've not tested them elsewhere. I've also attached a crash log with >asan reporting of each. > >Thank you >-Magnus L > >p.s. I've also opened github PR 449 with these same changes, but >figured I should send the patches via email as well-- if only for >practice :) Thanks a lot for the patches and reproducers! I saw the PR but I only had time to look at the "Fix use-after-free in openssl cert popup" commit which seems good. We are moving away from GitHub so it would be nice to send future patches here (or a link to a git repo/branch to fetch with git). It would help to describe what is the condition that triggers the UAF in the Http_server patch and why the change helps, so that it is easier to review. Perhaps it would be a good idea to put that information it in the commit summary of both patches so we can see it via git blame. Best, Rodrigo.

Jan. 24, 2026

Patches for two use-after-free bugs

by Nopey Nope

Hello! Find attached two patches, which each fix a use-after-free bug. I've also attached a crashing html document for each, but please be aware that these reproducer documents link urls from external web servers. The reproducers crash reliably on my x86_64 Void Linux laptop, but I've not tested them elsewhere. I've also attached a crash log with asan reporting of each. Thank you -Magnus L p.s. I've also opened github PR 449 with these same changes, but figured I should send the patches via email as well-- if only for practice :)

Jan. 24, 2026

Re: Segfault while running SSL Labs CurveBall test

by a1ex＠dismail.de

Hi Rodrigo, Rodrigo Arias <rodarima(a)gmail.com> wrote: > This patch should get rid of the segfault, but I need to take a closer > look and see if we are handling it well for LibreSSL, as they expose > headers from version 2 from OpenSSL. > > ---8<--- > diff --git a/src/IO/tls_openssl.c b/src/IO/tls_openssl.c > index 3345a0dc..d1df2315 100644 > --- a/src/IO/tls_openssl.c > +++ b/src/IO/tls_openssl.c > @@ -471,14 +471,12 @@ static bool_t Tls_check_cert_strength(SSL *ssl, Server_t *srv, int *choice) > char buf[buflen]; > int rc, i, n = sk_X509_num(sk); > X509 *cert = NULL; > - EVP_PKEY *public_key; > int key_type, key_bits; > const char *type_str; > BIO *b; > > for (i = 0; i < n; i++) { > cert = sk_X509_value(sk, i); > - public_key = X509_get_pubkey(cert); > > /* We are trying to find a way to get the hash function used > * with a certificate. This way, which is not very pleasant, puts > @@ -521,6 +519,10 @@ static bool_t Tls_check_cert_strength(SSL *ssl, Server_t *srv, int *choice) > if (print_chain) > MSG("%s ", buf); > > + EVP_PKEY *public_key = X509_get_pubkey(cert); > + if (public_key == NULL) > + continue; > + > #if OPENSSL_VERSION_NUMBER < 0x30000000L > key_type = EVP_PKEY_type(EVP_PKEY_id(public_key)); > #else > ---8<--- Thanks! Now the segfault is gone: Nav_open_url: new url='https://www.ssllabs.com:10446/' Dns_server [0]: www.ssllabs.com is 69.67.183.100 Connecting to 69.67.183.100:10446 www.ssllabs.com:10446: TLSv1.2, cipher ECDHE-ECDSA-AES256-GCM-SHA384 ecdsa-with-SHA256 384-bit EC: /C=US/ST=California/L=Foster City/O=Qualys, Inc./OU=SSLLabs CurveBall Leaf/CN=www.ssllabs.com ecdsa-with-SHA256 root: /C=US/ST=California/L=Foster City/O=Qualys, Inc./OU=SSLLabs/CN=SSLLabs CurveBall CA SSL_read() failed: error:10FFF010:elliptic curve routines:CRYPTO_internal:EC lib SSL_read() failed: error:10FFF07F:elliptic curve routines:CRYPTO_internal:pkparameters2group failure SSL_read() failed: error:10FFF010:elliptic curve routines:CRYPTO_internal:EC lib SSL_read() failed: error:10FFF08E:elliptic curve routines:CRYPTO_internal:decode error SSL_read() failed: error:0BFFF07D:x509 certificate routines:CRYPTO_internal:public key decode error Tls_close_by_key: Avoiding SSL shutdown for: https://www.ssllabs.com:10446/ Premature close for https://www.ssllabs.com:10446/ Regards, Alex

Jan. 16, 2026

Re: Avoid ctype(3) abuses

by Leonardo Taccari

Rodrigo Arias writes: > Hi, > > >Updated patches modified as required attached in this email. > > > >Now ctype(3) usage is only via d*() helper ctype(3) functions. > > Thanks!, it looks good. I will test it a bit and merge it if nothing > breaks. I will also add src/commit.h to .gitignore so we prevent this: > > >diff --git a/src/commit.h b/src/commit.h > >new file mode 100644 > >index 00000000..7c4f940d > >--- /dev/null > >+++ b/src/commit.h > >@@ -0,0 +1 @@ > >+#define GIT_COMMIT "v3.2.0-143-gabad1053-dirty" > [...] Whoops, sorry for that extra hunk! I was focused on double-checking the ctype(3) -> d*() helper transformations that I have completely missed that. :\ Thank you very much Rodrigo!

Jan. 16, 2026

Re: Avoid ctype(3) abuses

by Rodrigo Arias

>Thanks!, it looks good. I will test it a bit and merge it if nothing >breaks. I will also add src/commit.h to .gitignore so we prevent this: Merged.

Jan. 15, 2026