bugGNU nano - Bugs: bug #47511, an existing lockfile crashes nano...

 
 

bug #47511: an existing lockfile crashes nano when the filename is long

Submitted by:  Aapo Rantalainen <aapo>
Submitted on:  Wed 23 Mar 2016 08:20:04 PM UTC  
 
Severity: 4 - ImportantStatus: Fixed
Assigned to: Benno Schulenberg <bens>Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 20 Jun 2016 09:49:12 AM UTC, comment #4:

The fix has been released in 2.6.0. Thanks again for the report.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Sun 10 Apr 2016 09:42:56 AM UTC, comment #3:

Fixed in git, fb9585e.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 24 Mar 2016 08:22:37 PM UTC, comment #2:

Attached patch should fix the problem. If you could test it, that would be great.

(file #36756)

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 24 Mar 2016 06:19:51 PM UTC, comment #1:

Thanks for reporting.

Yes, nano allocates just 128 bytes for the entire prompt string... With a very long filename, this will overflow and crap on something else in the heap. Working on it.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Wed 23 Mar 2016 08:20:04 PM UTC, original submission:

Nano 2.5.3 (and 2.5.2, but not 2.2.6)

Steps to reproduce:
LANG=c bash
nano /tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio
save
modify

(another terminal: killall nano)
nano /tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio

#0 0xb7fdadad in __kernel_vsyscall ()
#1 0xb7dcf047 in __GI_raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:55
#2 0xb7dd0689 in __GI_abort () at abort.c:89
#3 0xb7e0d4be in __libc_message (do_abort=1, fmt=0xb7f07784 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#4 0xb7e13107 in malloc_printerr (action=<optimized out>, str=0xb7f03944 "malloc(): memory corruption", ptr=0x8093678) at malloc.c:4965
#5 0xb7e14798 in _int_malloc (av=av@entry=0xb7f5a840 <main_arena>, bytes=bytes@entry=113) at malloc.c:3441
#6 0xb7e15c0c in _int_realloc (av=av@entry=0xb7f5a840 <main_arena>, oldp=oldp@entry=0x80914e8, oldsize=24, nb=120) at malloc.c:4271
#7 0xb7e16d29 in __GI___libc_realloc (oldmem=0x80914f0, bytes=112) at malloc.c:3023
#8 0xb7f67573 in _nc_doalloc () from /lib/i386-linux-gnu/libtinfo.so.5
#9 0xb7f6b13f in _nc_tparm_analyze () from /lib/i386-linux-gnu/libtinfo.so.5
#10 0xb7f6b303 in tparm () from /lib/i386-linux-gnu/libtinfo.so.5
#11 0xb7f9a7e2 in vidputs () from /lib/i386-linux-gnu/libncursesw.so.5
#12 0xb7f9f96c in ?? () from /lib/i386-linux-gnu/libncursesw.so.5
#13 0xb7fa145e in ?? () from /lib/i386-linux-gnu/libncursesw.so.5
#14 0xb7fa1b68 in ?? () from /lib/i386-linux-gnu/libncursesw.so.5
#15 0xb7fa38ba in doupdate () from /lib/i386-linux-gnu/libncursesw.so.5
#16 0x0806a8ec in get_key_buffer (win=0x808d208) at ../../src/winio.c:123
#17 0x0806ab77 in get_input (win=0x808d208, input_len=1) at ../../src/winio.c:262
#18 0x0806acfc in parse_kbinput (win=0x808d208) at ../../src/winio.c:345
#19 0x0806ac75 in get_kbinput (win=0x808d208) at ../../src/winio.c:316
#20 0x0805ed77 in do_yesno_prompt (all=false,
msg=0x80935f0 "File /tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio is being edited (by user with nano 2.5.3, PID 8022); continue?")
at ../../src/prompt.c:876
#21 0x0804f4b9 in do_lockfile (filename=0xbffff2ee "/tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio") at ../../src/files.c:373
#22 0x0804f6f5 in open_buffer (filename=0xbffff2ee "/tmp/sdfgdrftgyusdfgsdfghjedrtyu345678dfrtgyujzxsdcfvgsdfgsdfgertyujklsdfgtyuijklsdfguio", undoable=false)
at ../../src/files.c:457
#23 0x0805d616 in main (argc=2, argv=0xbffff0d4) at ../../src/nano.c:2599
(gdb)

---
I think limit is 67 characters.
If LANG is localized limit is then lower.

Aapo Rantalainen <aapo>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #36756:  dottify-when-too-long.patch added by bens (3KiB - text/x-diff)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bens (Posted a comment)
  • -unavailable- added by aapo (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 20 Jun 2016 09:49:12 AM UTCbensOpen/ClosedOpen=>Closed
    Sun 10 Apr 2016 09:42:56 AM UTCbensStatusIn Progress=>Fixed
    Fri 25 Mar 2016 11:27:43 AM UTCbensSummaryfinding an existing lockfile crashes when the filename is long=>an existing lockfile crashes nano when the filename is long
    Thu 24 Mar 2016 08:22:37 PM UTCbensAttached File-=>Added dottify-when-too-long.patch, #36756
      Severity3 - Normal=>4 - Important
      StatusNone=>In Progress
      SummaryRecovery crashes with long filenames=>finding an existing lockfile crashes when the filename is long
    Thu 24 Mar 2016 06:19:51 PM UTCbensAssigned toNone=>bens

    Back to the top


    Powered by Savane 3.1-cleanup1