bugGNU nano - Bugs: bug #53972, nano crashes when a bind to a...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #53972: nano crashes when a bind to a string lacks the closing quote

Submitter:  None
Submitted:  Thu 24 May 2018 02:40:04 PM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Jump to the original submission

Fri 25 May 2018 11:18:51 AM UTC, comment #6: 

Thanks for testing.  Fixed pushed to master, commit 119a6f0d.

Benno Schulenberg <bens>
Group administrator
Thu 24 May 2018 11:10:36 PM UTC, comment #5: 

Seems fixed.

Anonymous
Thu 24 May 2018 06:30:51 PM UTC, comment #4: 

Attached patch should fix the problem.  Or do you still have other scenarios where an unfinished string can bring nano down?

(file #44213)

Benno Schulenberg <bens>
Group administrator
Thu 24 May 2018 04:00:50 PM UTC, comment #3: 

Yes, coming up with the smallest possible reproducer takes some work -- trimming, trimming, trying, trimming...

This is the result:

  echo 'bind ^B "boo' >~/.nanorc

Note the unpaired double quote.  This is enough to make nano segfault.

Benno Schulenberg <bens>
Group administrator
Thu 24 May 2018 03:19:32 PM UTC, comment #2: 

The problem is that creating such a corrupted file is not entirely obvious for me. I got it accidentally when I open my .nanorc file in gedit, made some changes and saved it. So, recipe to get a "corrupted" .nanorc file:

 - Create a .nanorc file with ^M special char in a text bind.
 - Open it in gedit, edit an unrelated part of it and save it.

I think this is enough to get a "corrupted" .nanorc file.

Anonymous
Thu 24 May 2018 03:04:48 PM UTC, comment #1: 

That is not a reproduction recipe.  A recipe does not require any example files.  Also, what is corrupt about the attached nanorc.bad?  It is totally unobvious and unclear to me.

A recipe does something like: echo "specific text" >~/.nanorc

Benno Schulenberg <bens>
Group administrator
Thu 24 May 2018 02:40:04 PM UTC, original submission:  

How to reproduce it:
 - Use the attached .nanorc.bad in place of your .nanorc
 - Run nano.

What happens:
 - Nano crashes

What should happen:
 - Nano should run normally and/or warn about corrupted .nanorc.

What causes the bug:
 - Parameter ptr is NULL when function parse_next_word in src/rcfile.c is called.

How to fix it:
 - Check if ptr is NULL in adequate places and warn accordingly. See attached patch.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #44211:  .nanorc.bad added by None (1KiB - application/octet-stream - File that triggers the bug and fix.)
file #44212:  0001-Avoid-crashing-if-.nanorc-is-coccupted.patch added by None (2KiB - text/x-patch - File that triggers the bug and fix.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-06-02 bens Open/ClosedOpen Closed
    2018-05-25 bens StatusIn Progress Fixed
    2018-05-24 bens Attached File- Added 0001-rcfile-don-t-crash-when-a-bind-to-a-string-lacks-the.patch, #44213
        StatusNone In Progress
    2018-05-24 bens Summarynano may crash if .nanorc is corrupted nano crashes when a bind to a string lacks the closing quote
    2018-05-24 bens Severity3 - Normal 4 - Important
        Assigned toNone bens
    2018-05-24 bens SummaryNano may crash if .nanorc is corrupted nano may crash if .nanorc is corrupted
    2018-05-24 None Attached File- Added .nanorc.bad, #44211
        Attached File- Added 0001-Avoid-crashing-if-.nanorc-is-coccupted.patch, #44212

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code