bugGNU nano - Bugs: bug #47795, segfault because of overflow in...

 
 

bug #47795: segfault because of overflow in version 2.4.2

Submitted by:  z00 <blackzero>
Submitted on:  Thu 28 Apr 2016 02:36:04 AM UTC  
 
Severity: 3 - NormalStatus: Fixed
Assigned to: Benno Schulenberg <bens>Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 28 Apr 2016 06:29:52 PM UTC, comment #6:

Closing this, as the fix has been released, in 2.4.3.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 28 Apr 2016 01:51:20 PM UTC, comment #5:

yes there is a memory leak in the previous version, the latest version has been fixed completely :)

z00 <blackzero>
Thu 28 Apr 2016 01:37:32 PM UTC, comment #4:

Ah, I hadn't realized there were pictures attached -- I hadn't scrolled down that far. But... I'm not going to look at binary files from an untrusted user.

Anyway, running valgrind on 'src/nano one two' and then typing ^X ^X to close both empty buffers, shows this:

==4744== Conditional jump or move depends on uninitialised value(s)
==4744== at 0x8061EBD: edit_draw (winio.c:2610)
==4744== by 0x8062936: update_line (winio.c:2895)
==4744== by 0x8062ACD: edit_refresh (winio.c:3210)
==4744== by 0x804E144: switch_to_prevnext_buffer (files.c:470)
==4744== by 0x805044B: close_buffer (files.c:514)
==4744== by 0x8056822: do_exit (nano.c:1137)
==4744== by 0x8057774: do_input (nano.c:1702)
==4744== by 0x805827E: main (nano.c:2806)
==4744== Uninitialised value was created by a stack allocation
==4744== at 0x8061B99: edit_draw (winio.c:2449)

That is with 2.4.2. It doesn't happen any more in 2.5.3, nor in git HEAD. I think most memory leaks and other such things have been fixed by now.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 28 Apr 2016 01:32:17 PM UTC, comment #3:

I tried this version

z00@0x66:~/exploiting/nano-bin/bin$ ./nano --version
GNU nano from git, commit b26aaa7 (after 2.5.3)
(C) 1999..2016 Free Software Foundation, Inc.
Email: -unavailable- Web: http://www.nano-editor.org/
Compiled options: --disable-libmagic --enable-debug --disable-utf8

in this version no problem, however, I'm using xubuntu 15.10 Ubuntu self-I think I should take in this situation
GNU nano, version 2.4.2..

Thank you for your attention, have a nice day :)

z00 <blackzero>
Thu 28 Apr 2016 01:13:36 PM UTC, comment #2:

Yes, when the file is opened press CTRL+C and enter I showed in the pictures, today I'll try and unprotected stack developer version download I'll let you know.

z00 <blackzero>
Thu 28 Apr 2016 06:46:49 AM UTC, comment #1:

What's in $z00? When I run 'src/nano $z00 = "electrocode";', it opens two empty files for me: = and electrocode. I don't see what the <Enter> is supposed to do. And instead of Ctrl+C you mean Ctrl+X? In short, I cannot reproduce, not with 2.4.2, not with the latest.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 28 Apr 2016 02:36:04 AM UTC, original submission:

Hi,

the dangerous situation may be different overflow..

example :

nano $z00 = "electrocode"; (enter)
(ctrl+c ctrl+c)
nano $z00 = "electrocode"; (enter)
(ctrl+c ctrl+c)

regards..

z00 <blackzero>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #37006:  nano-0day.png added by blackzero (332KiB - image/png - Segfault overflow examples)
file #37007:  nano-0day-dmesg.png added by blackzero (35KiB - image/png - Segfault overflow examples)
file #37008:  nano-0day-2.png added by blackzero (240KiB - image/png - Segfault overflow examples)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bens (Posted a comment)
  • -unavailable- added by blackzero (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 28 Apr 2016 06:30:05 PM UTCbensOpen/ClosedOpen=>Closed
    Thu 28 Apr 2016 06:29:52 PM UTCbensStatusNone=>Fixed
    Thu 28 Apr 2016 01:37:32 PM UTCbensAssigned toNone=>bens
      SummarySegfault overflow GNU nano, version 2.4.2=>segfault because of overflow in version 2.4.2
    Thu 28 Apr 2016 02:36:04 AM UTCblackzeroAttached File-=>Added nano-0day.png, #37006
      Attached File-=>Added nano-0day-dmesg.png, #37007
      Attached File-=>Added nano-0day-2.png, #37008

    Back to the top


    Powered by Savane 3.1-cleanup1