GNU nano - Bugs: bug #53269, direct leak of 104 byte(s) of...
You are not allowed to post comments on this tracker with your current authentication level.
bug #53269: direct leak of 104 byte(s) of memory
Submitter: | Ashish Kunwar <dorkerdevil> | ||
Submitted: | Fri 02 Mar 2018 05:06:22 PM UTC | ||
Votes: | 100 | ||
Severity: | 2 - Minor | Status: | Fixed |
Assigned to: | bens | Open/Closed: | Closed |
Jump to the original submission
Fri 30 Mar 2018 09:22:14 AM UTC, comment #17: |
Benno Schulenberg <bens> |
Sun 11 Mar 2018 07:24:06 PM UTC, comment #16: The leak has been fixed in git, commit e8505b2d.
|
Benno Schulenberg <bens> |
Tue 06 Mar 2018 05:25:44 AM UTC, comment #15: Ashish, can you attach that crash file with a simpler name? For example: "crashesnano".
|
Ashish Kunwar <dorkerdevil> |
Mon 05 Mar 2018 07:36:24 PM UTC, comment #14: Ashish, I don't see any new attachment to this bug. But... the real question is: can you make nano crash with that file? Or is it just another false positive, like the 178 that afl has found here by now? |
Benno Schulenberg <bens> |
Mon 05 Mar 2018 11:46:21 AM UTC, comment #13: Yes the reproduction file I attached can be tried for ease and it does the same work as the original one.
|
Ashish Kunwar <dorkerdevil> |
Mon 05 Mar 2018 10:23:11 AM UTC, comment #12: Well, I have installed afl, and after running for an hour, it thinks to have found 129 unique crashes. But... I can open each of those 129 "crash files" without a problem. So... afl's thoughts about what constitutes a crash seem to be a bit off? |
Benno Schulenberg <bens> |
Mon 05 Mar 2018 08:32:56 AM UTC, comment #11: Thanks, Brian, for the explanation. Much appreciated.
|
Benno Schulenberg <bens> |
Sat 03 Mar 2018 04:44:41 PM UTC, comment #10: I think he was confused on how to reproduce a crash triggered by AFL. His fuzzing command line was ‘afl-fuzz -m none -i input_dir -o output_dir — ./nano -v -‘ where nano is just viewing a file from STDIN. To reproduce the crash he should have just ran ‘./nano -v file_name’ but instead he told nano to read from STDIN and then read the crash reproducer which produced the memory leak. Nice unintended bug find though. Not sure if he has actually reproduced a crash but that is what id:000000,sig:06,src:000005,op:flip1,pos:A8 is, the reproducer file for whatever AFL though caused a crash. |
Brian Carpenter <geeknik> |
Sat 03 Mar 2018 04:42:17 PM UTC, comment #9: that is not just a strange long filename
|
Ashish Kunwar <dorkerdevil> |
Sat 03 Mar 2018 04:35:30 PM UTC, comment #8: Oh, and when you close nano with ^X, I don't think it reopens -- it just looks that way because you're running it in some kind of debugger and things go slow? The first ^X just closes the first buffer (the stuff read from standard input, "-"), and the second ^X closed the second buffer, the one with the strange long file name that you used: "id:000000,sig:06,src:000005,op:flip1,pos:A8". |
Benno Schulenberg <bens> |
Sat 03 Mar 2018 04:31:14 PM UTC, comment #7: I don't understand what "id:000000,sig:06,src:000005,op:flip1,pos:A8" is doing on one of your command lines. Nano sees it as a file name. If instead you use README, or some other simple file name, you will get the same result: 104 bytes lost. |
Benno Schulenberg <bens> |
Sat 03 Mar 2018 01:33:23 PM UTC, comment #6: yeah i totally understand what you means , so now let me explain what i did and how i triggered it.
|
Ashish Kunwar <dorkerdevil> |
Sat 03 Mar 2018 01:28:22 PM UTC, comment #5: (The "Gone undo line" bug has been reported as bug #53272.) |
Benno Schulenberg <bens> |
Sat 03 Mar 2018 01:21:05 PM UTC, comment #4: I have no idea what a POC is. And I don't know what to do with a crash file -- and even if I knew, you will understand that I won't touch any binary files.
|
Benno Schulenberg <bens> |
Sat 03 Mar 2018 03:06:05 AM UTC, comment #3: sorry for wrong keyword its Fuzzer,
|
Ashish Kunwar <dorkerdevil> |
Sat 03 Mar 2018 03:02:11 AM UTC, comment #2: The file I attached is a crash file generated by the fizzer as a poc |
Ashish Kunwar <dorkerdevil> |
Fri 02 Mar 2018 07:09:39 PM UTC, comment #1: Hello Ashish,
|
Benno Schulenberg <bens> |
Fri 02 Mar 2018 05:06:22 PM UTC, original submission:
Hello, my name is Ashish Kunwar a security researcher from India.
|
Ashish Kunwar <dorkerdevil> |
Depends on the following items: None found
Items that depend on this one: None found
There are 100 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2018-03-30 | bens | Open/Closed | Open | Closed | |
2018-03-11 | bens | Severity | 3 - Normal | 2 - Minor | |
Status | None | Fixed | |||
2018-03-06 | dorkerdevil | Attached File | - | Added crashesnano, #43472 | |
2018-03-03 | dorkerdevil | Carbon-Copy | - | Added -email is unavailable- | |
2018-03-02 | bens | Assigned to | None | bens | |
Summary | Direct leak of 104 byte(s) memory | direct leak of 104 byte(s) of memory | |||
2018-03-02 | dorkerdevil | Carbon-Copy | - | Added dorkerdevil | |
2018-03-02 | dorkerdevil | Attached File | - | Added id%3A000000,sig%3A06,src%3A000005,op%3Aflip1,pos%3A8, #43438 |
Powered by Savane 3.13-f8d8.
Corresponding source code
Fix was released in 2.9.5.