bugGNU nano - Bugs: bug #58959, with --disable-utf8, nano crashes...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58959: with --disable-utf8, nano crashes upon "M-V M-Ins"

Submitter:  Benno Schulenberg <bens>
Submitted:  Sat 15 Aug 2020 08:56:47 AM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Sat 15 Aug 2020 10:45:19 AM UTC, comment #4: 

Fixed in git, commit 3cb55c8b.

(Bug existed since version 4.9.)

Benno Schulenberg <bens>
Group administrator
Sat 15 Aug 2020 09:49:27 AM UTC, comment #3: 

Bug exists since version 4.8.  The offending commit is 03d296eb: "allocate sufficient bytes for entering a Unicode codepoint".

Benno Schulenberg <bens>
Group administrator
Sat 15 Aug 2020 09:15:20 AM UTC, comment #2: 

The problem is that get_verbatim_kbinput() reserves MAXCHARLEN + 1 bytes for the result, and for non-UTF-8 locales MAXCHARLEN can be 1, whereas count (the number of codes that come out of parse_verbatim_kbinput()) can be 2.  Oops.

Benno Schulenberg <bens>
Group administrator
Sat 15 Aug 2020 09:09:01 AM UTC, comment #1: 

Valgrind reports this:

==8938== Invalid write of size 1
==8938==    at 0x12ED6D: get_verbatim_kbinput (winio.c:1502)
==8938==    by 0x12C392: do_verbatim_input (text.c:3019)
==8938==    by 0x11E82A: process_a_keystroke (nano.c:1628)
==8938==    by 0x11FD56: main (nano.c:2513)
==8938==  Address 0x5a5c482 is 0 bytes after a block of size 2 alloc'd
==8938==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==8938==    by 0x12CC6A: nmalloc (utils.c:295)
==8938==    by 0x12EC83: get_verbatim_kbinput (winio.c:1452)
==8938==    by 0x12C392: do_verbatim_input (text.c:3019)
==8938==    by 0x11E82A: process_a_keystroke (nano.c:1628)
==8938==    by 0x11FD56: main (nano.c:2513)

Benno Schulenberg <bens>
Group administrator
Sat 15 Aug 2020 08:56:47 AM UTC, original submission:  

To reproduce, configure nano with --disable-utf8, compile, and then run 'src/nano --ignore', and type: M-V M-Ins

Result: nano prints "free(): invalid pointer" and the terminal is completely stuck.

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-08-25 bens Open/ClosedOpen Closed
    2020-08-15 bens Summarywith --disable-utf8, nano crashes upon for &quot;M-V M-Ins&quot; with --disable-utf8, nano crashes upon "M-V M-Ins"
    2020-08-15 bens StatusIn Progress Fixed
    2020-08-15 bens StatusNone In Progress

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code