bugGNU nano - Bugs: bug #47511, an existing lockfile crashes nano...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #47511: an existing lockfile crashes nano when the filename is long

Submitter:  Aapo Rantalainen <aapo>
Submitted:  Wed 23 Mar 2016 08:20:04 PM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Mon 20 Jun 2016 09:49:12 AM UTC, comment #4: 

The fix has been released in 2.6.0.  Thanks again for the report.

Benno Schulenberg <bens>
Group administrator
Sun 10 Apr 2016 09:42:56 AM UTC, comment #3: 

Fixed in git, fb9585e.

Benno Schulenberg <bens>
Group administrator
Thu 24 Mar 2016 08:22:37 PM UTC, comment #2: 

Attached patch should fix the problem.  If you could test it, that would be great.

(file #36756)

Benno Schulenberg <bens>
Group administrator
Thu 24 Mar 2016 06:19:51 PM UTC, comment #1: 

Thanks for reporting.

Yes, nano allocates just 128 bytes for the entire prompt string...  With a very long filename, this will overflow and crap on something else in the heap.  Working on it.

Benno Schulenberg <bens>
Group administrator
Wed 23 Mar 2016 08:20:04 PM UTC, original submission:  

Nano 2.5.3 (and 2.5.2, but not 2.2.6)

Steps to reproduce:
LANG=c bash
nano /tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio
save
modify

(another terminal: killall nano)
nano /tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio


#0  0xb7fdadad in __kernel_vsyscall ()
#1  0xb7dcf047 in __GI_raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:55
#2  0xb7dd0689 in __GI_abort () at abort.c:89
#3  0xb7e0d4be in __libc_message (do_abort=1, fmt=0xb7f07784 "*** Error in `%s': %s: 0x%s *\n") at ../sysdeps/posix/libc_fatal.c:175
#4  0xb7e13107 in malloc_printerr (action=<optimized out>, str=0xb7f03944 "malloc(): memory corruption", ptr=0x8093678) at malloc.c:4965
#5  0xb7e14798 in _int_malloc (av=av@entry=0xb7f5a840 <main_arena>, bytes=bytes@entry=113) at malloc.c:3441
#6  0xb7e15c0c in _int_realloc (av=av@entry=0xb7f5a840 <main_arena>, oldp=oldp@entry=0x80914e8, oldsize=24, nb=120) at malloc.c:4271
#7  0xb7e16d29 in __GI___libc_realloc (oldmem=0x80914f0, bytes=112) at malloc.c:3023
#8  0xb7f67573 in _nc_doalloc () from /lib/i386-linux-gnu/libtinfo.so.5
#9  0xb7f6b13f in _nc_tparm_analyze () from /lib/i386-linux-gnu/libtinfo.so.5
#10 0xb7f6b303 in tparm () from /lib/i386-linux-gnu/libtinfo.so.5
#11 0xb7f9a7e2 in vidputs () from /lib/i386-linux-gnu/libncursesw.so.5
#12 0xb7f9f96c in ?? () from /lib/i386-linux-gnu/libncursesw.so.5
#13 0xb7fa145e in ?? () from /lib/i386-linux-gnu/libncursesw.so.5
#14 0xb7fa1b68 in ?? () from /lib/i386-linux-gnu/libncursesw.so.5
#15 0xb7fa38ba in doupdate () from /lib/i386-linux-gnu/libncursesw.so.5
#16 0x0806a8ec in get_key_buffer (win=0x808d208) at ../../src/winio.c:123
#17 0x0806ab77 in get_input (win=0x808d208, input_len=1) at ../../src/winio.c:262
#18 0x0806acfc in parse_kbinput (win=0x808d208) at ../../src/winio.c:345
#19 0x0806ac75 in get_kbinput (win=0x808d208) at ../../src/winio.c:316
#20 0x0805ed77 in do_yesno_prompt (all=false,
    msg=0x80935f0 "File /tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio is being edited (by user with nano 2.5.3, PID 8022); continue?")
    at ../../src/prompt.c:876
#21 0x0804f4b9 in do_lockfile (filename=0xbffff2ee "/tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio") at ../../src/files.c:373
#22 0x0804f6f5 in open_buffer (filename=0xbffff2ee "/tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio", undoable=false)
    at ../../src/files.c:457
#23 0x0805d616 in main (argc=2, argv=0xbffff0d4) at ../../src/nano.c:2599
(gdb)


---
I think limit is 67 characters.
If LANG is localized limit is then lower.

Aapo Rantalainen <aapo>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #36756:  dottify-when-too-long.patch added by bens (3KiB - text/x-diff)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by aapo (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-06-20 bens Open/ClosedOpen Closed
    2016-04-10 bens StatusIn Progress Fixed
    2016-03-25 bens Summaryfinding an existing lockfile crashes when the filename is long an existing lockfile crashes nano when the filename is long
    2016-03-24 bens Attached File- Added dottify-when-too-long.patch, #36756
        Severity3 - Normal 4 - Important
        StatusNone In Progress
        SummaryRecovery crashes with long filenames finding an existing lockfile crashes when the filename is long
    2016-03-24 bens Assigned toNone bens

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code