bugGNU nano - Bugs: bug #65394, invalid read in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65394: invalid read in snip_last_keystroke() when typing M-: twice fast

Submitter:  correctmost <correctmost>
Submitted:  Sat 02 Mar 2024 01:23:06 AM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Open

Fri 22 Mar 2024 03:41:11 PM UTC, comment #4: 

Commit 91cf671 caused a major regression (bug #65507), so it was reverted.

The invalid read has been prevented in a simpler way by commit 3fb8efc8, by simply checking that 'macro_length' does not go through the floor.

Benno Schulenberg <bens>
Group administrator
Sun 03 Mar 2024 10:09:54 AM UTC, comment #3: 

Fixed in git, commit 191cf671, by moving the recording of keystrokes in the macrobuffer to its proper spot: the routine that reads a keystroke from nano's own keystroke buffer.

Thanks for reporting the problem, and for keeping on hammering nano with wild-monkey keystrokes.  :)

Benno Schulenberg <bens>
Group administrator
Sat 02 Mar 2024 11:29:04 AM UTC, comment #2: 

Ah.  When the second M-: arrives before the first one is processed (that is: the first one is still in nano's keystroke buffer), then 'recording' is still false and the second M-: will not be stored in the macro buffer.  But when the second M-: is processed, then it expects its corresponding keystroke to be in the macro buffer.  :/

Nano shouldn't store keystrokes in the macro buffer when they come in from ncurses, but when nano reads them from its own keystroke buffer.  This also avoids storing useless ERR values in the macro buffer.

Benno Schulenberg <bens>
Group administrator
Sat 02 Mar 2024 11:09:32 AM UTC, comment #1: 

I don't have a remote machine with valgrind installed and can't be bothered to set up a virtual machine, but... I can reliably make nano (inside valgrind) crash by quickly typing M-: twice while valgrind+nano is starting up.

And I can reliably get your result when inserting a `napms(100);` before the `while (TRUE)` on line 292 of src/winio.c -- then holding down M-: for two seconds and then ^X shows the invalid read.

Benno Schulenberg <bens>
Group administrator
Sat 02 Mar 2024 01:23:06 AM UTC, original submission:  

I can reliably reproduce the following bug when I ssh into a test VM using mate-terminal or xfce4-terminal.  I cannot reproduce the bug inside the test VM itself (even though the bug was first discovered via xdotool).

Steps to reproduce:
1 - ssh into a machine with valgrind and the latest nano
2 - Run `valgrind nano --ignore`
3 - Hold down Alt + :


Valgrind output:

==74802== Invalid read of size 4
==74802==    at 0x139CFF: snip_last_keystroke (winio.c:95)
==74802==    by 0x139D68: record_macro (winio.c:108)
==74802==    by 0x126163: process_a_keystroke (nano.c:1685)
==74802==    by 0x127FC4: main (nano.c:2651)
==74802==  Address 0x4d16a68 is 8 bytes before a block of size 8 alloc'd
==74802==    at 0x484ABC0: realloc (vg_replace_malloc.c:1690)
==74802==    by 0x139503: nrealloc (utils.c:304)
==74802==    by 0x139C87: add_to_macrobuffer (winio.c:87)
==74802==    by 0x13A263: read_keys_from (winio.c:295)
==74802==    by 0x13A5ED: get_input (winio.c:412)
==74802==    by 0x13B593: parse_kbinput (winio.c:1017)
==74802==    by 0x13C1AC: get_kbinput (winio.c:1374)
==74802==    by 0x125DBF: process_a_keystroke (nano.c:1573)
==74802==    by 0x127FC4: main (nano.c:2651)


Observations:

It appears that `add_to_macrobuffer` is not always called.  This leads to `snip_last_keystroke` decrementing a size_t `macro_length` that is already assigned 0.


Version: 3098315e05e343ecf3c5d6f5fa65ff366d0bd1d6

correctmost <correctmost>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by correctmost (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-03-03 bens StatusIn Progress Fixed
    2024-03-02 bens StatusNone In Progress
        Summaryinvalid read in snip_last_keystroke() invalid read in snip_last_keystroke() when typing M-: twice fast
    2024-03-02 bens Assigned toNone bens
        Summaryinvalid read in snip_last_keystroke invalid read in snip_last_keystroke()

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code