bugGNU nano - Bugs: bug #47199, invalid read when tabbing on a...

 
 

bug #47199: invalid read when tabbing on a fragment of an existing filename

Submitted by:  Benno Schulenberg <bens>
Submitted on:  Fri 19 Feb 2016 12:15:25 PM UTC  
 
Severity: 3 - NormalStatus: Fixed
Assigned to: Benno Schulenberg <bens>Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 20 Feb 2016 12:28:56 PM UTC, comment #2:

Turns out it wasn't related to the other bug.

Fixed in SVN, r5654.

(That whole routine could use a little cleanup.)

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Fri 19 Feb 2016 06:37:14 PM UTC, comment #1:

The fragment needs to be at least two characters shorter than the complete filename.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Fri 19 Feb 2016 12:15:25 PM UTC, original submission:

To reproduce, do 'touch wwwwaaaa', then run nano, and type:
^R ww <Tab> ^C ^X.

==3334== Invalid read of size 1
==3334== at 0x40C5880: mblen (mblen.c:53)
==3334== by 0x804C36C: parse_mbchar (chars.c:407)
==3334== by 0x804EE8E: input_tab (files.c:2833)
==3334== by 0x805969D: get_prompt_string (prompt.c:627)
==3334== by 0x80598C0: do_prompt (prompt.c:764)
==3334== by 0x8051771: do_insertfile (files.c:1139)
==3334== by 0x8051AE8: do_insertfile_void (files.c:1384)
==3334== by 0x8057BC5: do_input (nano.c:1722)
==3334== by 0x8058719: main (nano.c:2681)
==3334== Address 0x4851d33 is 0 bytes after a block of size 3 alloc'd
==3334== at 0x4025016: realloc (vg_replace_malloc.c:525)
==3334== by 0x806100F: nrealloc (utils.c:400)
==3334== by 0x805910C: do_statusbar_output (prompt.c:288)
==3334== by 0x805930A: do_statusbar_input (prompt.c:125)
==3334== by 0x80595B4: get_prompt_string (prompt.c:593)
==3334== by 0x80598C0: do_prompt (prompt.c:764)
==3334== by 0x8051771: do_insertfile (files.c:1139)
==3334== by 0x8051AE8: do_insertfile_void (files.c:1384)
==3334== by 0x8057BC5: do_input (nano.c:1722)
==3334== by 0x8058719: main (nano.c:2681)

I don't get line 288 in prompt.c: why does it need twice the size character buffer?

answer = charealloc(answer, answer_len + (char_buf_len * 2));

If I add a '+ 1' before the final parenthesis, things get only worse: there's not just the "Invalid read of size 1", there's also a "Conditional jump or move depends on uninitialised value(s)". Pfff....

Most likely this is related to bug #47124, just a different symptom.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bens (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 27 Feb 2016 03:09:06 PM UTCbensOpen/ClosedOpen=>Closed
    Sat 20 Feb 2016 12:28:56 PM UTCbensStatusNone=>Fixed
      Assigned toNone=>bens
    Fri 19 Feb 2016 06:37:14 PM UTCbensSummaryinvalid read when tabbing on a filename=>invalid read when tabbing on a fragment of an existing filename

    Back to the top


    Powered by Savane 3.1-cleanup1