GNU nano - Bugs: bug #50056, crash with empty start and end...
You are not allowed to post comments on this tracker with your current authentication level.
bug #50056: crash with empty start and end regex for "color" in .nanorc
Submitter: | None | ||
Submitted: | Sun 15 Jan 2017 05:53:12 PM UTC | ||
Severity: | 3 - Normal | Status: | Fixed |
Assigned to: | bens | Open/Closed: | Closed |
Jump to the original submission
Fri 24 Feb 2017 10:21:24 AM UTC, comment #10: |
Benno Schulenberg <bens> |
Fri 20 Jan 2017 04:41:11 PM UTC, comment #9: Fixed in git, 9de376de.
|
Benno Schulenberg <bens> |
Wed 18 Jan 2017 06:59:12 PM UTC, comment #8: Thanks for testing. Here is a slightly different patch. If you could test this one too...
|
Benno Schulenberg <bens> |
Wed 18 Jan 2017 12:24:31 AM UTC, comment #7: I fuzzed for three hours with the new patch and everything looks fine. (The other crashes were generated after 10 minutes or so) |
Elia Geretto <aliverix> |
Tue 17 Jan 2017 08:52:22 PM UTC, comment #6: Thanks. Problem is reproducible. But trying to run valgrind on it just hangs. Checking with older versions, it appears that the segfault happens since nano-2.5.1 -- before that, nano just hung with a blank screen.
|
Benno Schulenberg <bens> |
Tue 17 Jan 2017 05:40:05 PM UTC, comment #5: From what I see in your patch, you are checking whether the regular expressions for start and end are empty. This is actually not sufficient because it is possible to obtain the same effect, which is what the fuzzer did, with other expressions, as for example "|" or "|abc", or even "a*". I am uploading another file that makes the program crash at the same point. |
Elia Geretto <aliverix> |
Mon 16 Jan 2017 03:54:41 PM UTC, comment #4: Here is a patch that should avoid the problem. If you can run that through AFL for a while, that would be great.
|
Benno Schulenberg <bens> |
Sun 15 Jan 2017 08:03:01 PM UTC, comment #3: I ran it just for a couple of hours, I actually found this bug as part of a university assignment. Regarding the set up part, it is quite easy if you just want to fake user input, given that it's taken from stdin. It is a little more difficult if you want to fuzz the configuration files because there is no easy way (that I know of) to make nano parse an arbitrary file. I had to make some changes in the code, a dirty fix that adds a command line argument that allows to pass an arbitrary configuration file.
|
Elia Geretto <aliverix> |
Sun 15 Jan 2017 06:54:14 PM UTC, comment #2: Wow. Thanks for the report. I've already looked how this can be avoided, but don't have the time right now to make a patch.
|
Benno Schulenberg <bens> |
Sun 15 Jan 2017 05:57:30 PM UTC, comment #1: I didn't realize I was posting as "Anonymous", I am willing to provide additional details if necessary. |
Elia Geretto <aliverix> |
Sun 15 Jan 2017 05:53:12 PM UTC, original submission:
A segmentation fault occurs when the following rule is inserted in a syntax specification inside a configuration file:
|
Anonymous |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 11 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2017-02-24 | bens | Open/Closed | Open | Closed | |
2017-01-20 | bens | Status | Ready For Test | Fixed | |
Summary | Crash with empty begin and end regex for "color" in .nanorc | crash with empty start and end regex for "color" in .nanorc | |||
2017-01-18 | bens | Attached File | - | Added 0001-painting-stay-within-the-line-when-skipping-zero-len.patch, #39501 | |
Status | In Progress | Ready For Test | |||
2017-01-17 | bens | Attached File | - | Added crude.patch, #39499 | |
2017-01-17 | aliverix | Attached File | - | Added nanorc_crash_new, #39497 | |
2017-01-16 | bens | Attached File | - | Added 0001-rcfile-don-t-accept-empty-regexes-for-syntax-colorin.patch, #39490 | |
Status | None | In Progress | |||
2017-01-15 | bens | Assigned to | None | bens | |
2017-01-15 | None | Attached File | - | Added nanorc_crash, #39485 |
Powered by Savane 3.13-f8d8.
Corresponding source code
Released in 2.7.5. Thanks again for reporting.