bugGNU nano - Bugs: bug #59419, linter can place cursor beyond...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #59419: linter can place cursor beyond EOL, leading to a segmentation fault upon typing

Submitter:  Ava McWhorter <megidont>
Submitted:  Thu 05 Nov 2020 04:48:54 PM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Thu 03 Dec 2020 11:15:39 AM UTC, comment #3: 

Released in nano-5.4.

Benno Schulenberg <bens>
Group administrator
Fri 06 Nov 2020 10:01:11 AM UTC, comment #2: 

Fixed in git, commit 7f184ee2, by limiting 'current_x' to an index within the line.

Benno Schulenberg <bens>
Group administrator
Fri 06 Nov 2020 09:10:11 AM UTC, comment #1: 

Thank you for the detailed bug report.  However, I do not have the 'jshint' program (nor can I find it among the software that Ubuntu offers), so I simulated it by adding at the end of my ~/.nanorc:

extendsyntax javascript linter ./fakelinter.sh

And created in the current directory a fake linter script:

#!/bin/sh
echo "nanoCrash.js:1,28: foutje, bedankt"

Then I run 'nano nanoCrash.js' and type:
M-B <Enter> x
Result: Segmentation fault.

The offending commit is 2439e1e4 from three years ago, which fixed bug #47131.  The strange thing is: how can 'jshint' report a column number, how can it know what tabsize you use?  Gcc reports a character position, not a column number.  What other linters do, I don't know, but as the original code (from Chris) assumed that the second number refered to a column, I suppose there are other linters (beside 'jshint') that report a column number too.  If it somehow were possible to distinguish between the two (say, a separating colon means column, a separating comma a character position), then we could do the right thing.  But now...  I will keep interpreting the second number as a byte index in the line, but will make sure that it does not point outside the line.

Benno Schulenberg <bens>
Group administrator
Thu 05 Nov 2020 04:48:54 PM UTC, original submission:  

Nano seems to place the cursor at the character location specified by a linter. However, many linters specify a location based on column number, with the assumption that a tab will increase the column number by a certain amount (usually greater than one). As a result, a linter returning an error at the end of a line that begins with tabs (for example, a javascript line lacking a semicolon within an indented block) will sometimes move the cursor out of bound, and any attempts to type lead to an immediate segmentation fault.

It may be necessary to move the cursor to column number rather than to character position, or alternatively to check for the cursor being placed out of bounds by the linter and move it instead to the end of the line.

Attached are three files:
1) a nanorc file specifying jshint as the linter, along with a reporter script that translates its output into a form that nano can use
2) the specified reporter script
3) a file that, when the linter is called upon it, will specify an error that places the cursor out of bounds.

Ava McWhorter <megidont>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #50209:  js.nanorc added by megidont (36B - application/octet-stream)
file #50210:  nanoCrash.js added by megidont (20B - application/x-javascript)
file #50211:  reporter.js added by megidont (423B - application/x-javascript)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by megidont (Submitted the item)
  • -email is unavailable- added by megidont
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-12-03 bens Open/ClosedOpen Closed
    2020-11-06 bens StatusIn Progress Fixed
    2020-11-06 bens Severity3 - Normal 4 - Important
        StatusNone In Progress
        Assigned toNone bens
        SummaryLinter can place cursor out of the boundaries of the line, leading to segmentation faults upon attempts to type linter can place cursor beyond EOL, leading to a segmentation fault upon typing
    2020-11-05 megidont Attached File- Added js.nanorc, #50209
        Attached File- Added nanoCrash.js, #50210
        Attached File- Added reporter.js, #50211
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code