bugGNU nano - Bugs: bug #59854, 'lsan' reports a leak upon exit...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #59854: 'lsan' reports a leak upon exit after doing spell checking

Submitter:  Mike Frysinger <vapier>
Submitted:  Mon 11 Jan 2021 12:23:13 PM UTC
   
 
Severity:  2 - Minor Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Jump to the original submission

Fri 15 Jan 2021 10:54:54 AM UTC, comment #11: 

The leak fix is released in nano-5.5.

Benno Schulenberg <bens>
Group administrator
Tue 12 Jan 2021 10:35:33 AM UTC, comment #10: 

Don't worry about the sleuthing: it is what I like doing.  If not, I would have given up fixing bugs in nano a long time ago.  :)  Also, it helped discover a related bug (bug #59855), which I probably would not have found if you had given a clearer reproduction recipe.  So, it's all good.

(After you mentioned that the problem occurred after multiple spell checks, I can now reproduce the sanitizer output by doing two spell checks before exiting -- when going back a few commits.  In current git, things are fine.)

(I will close the bug when the fix is released, in a few days.)

Benno Schulenberg <bens>
Group administrator
Mon 11 Jan 2021 07:05:49 PM UTC, comment #9: 

I'm just thinking of the next bug I report. would be nice if it had some sort of trail to go with it so you don't have to do as much sleuthing.

I've been running sanitizer builds for a while but been bad at forwarding the failures.

if you think you've fixed it, feel free to close it out. I'll rebuild, but wasn't able to repro reliably to try and verify the fix.

Mike Frysinger <vapier>
Group Member
Mon 11 Jan 2021 06:41:45 PM UTC, comment #8: 

I think commit bc368133 fixes the leak.

Benno Schulenberg <bens>
Group administrator
Mon 11 Jan 2021 03:43:06 PM UTC, comment #7: 

Aah...  I've adjusted the subject line accordingly.

Looking closer at construct_argument_list() and its calls, it's clear that 'arguments' is allocated but never freed, not by the spell checker nor by the linter.  For the linter this is easy to fix, but for treat()... there are two extra exit points before 'arguments' becomes unused.  :|

Working on it.

(Using --enable-debug in nano won't bring any extra info: most of the debugging code has become obsolete and has been removed over the past years.)

Benno Schulenberg <bens>
Group administrator
Mon 11 Jan 2021 03:20:30 PM UTC, comment #6: 

perhaps "crash" is imprecise. lsan processes leaks when exiting, so I had finished editing, saved, then exited, and that's when lsan fired. it forces non zero exit.

i can see if enabling nano debug mode is feasible ...

Mike Frysinger <vapier>
Group Member
Mon 11 Jan 2021 03:11:57 PM UTC, comment #5: 

The subject line says that nano crashed while editing.  Is that correct?  Or was the actual crash at the moment of invoking the spell checker for an nth time?

(The --speller="" crash has been rereported as bug #59855, and fixed.)

Benno Schulenberg <bens>
Group administrator
Mon 11 Jan 2021 01:35:32 PM UTC, comment #4: 

Hmm.  I can produce a crash when using --speller="".

==31740== Invalid write of size 8
==31740==    at 0x12C53A: construct_argument_list (text.c:2043)
==31740==    by 0x12C6FD: treat (text.c:2121)
==31740==    by 0x12D3DD: do_spell (text.c:2537)
==31740==    by 0x121B8F: do_statusbar_input (prompt.c:355)
==31740==    by 0x122162: acquire_an_answer (prompt.c:465)
==31740==    by 0x122574: do_prompt (prompt.c:608)
==31740==    by 0x115E39: do_insertfile (files.c:1150)
==31740==    by 0x120F6B: process_a_keystroke (nano.c:1625)
==31740==    by 0x10E0EF: main (nano.c:2544)
==31740==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

Benno Schulenberg <bens>
Group administrator
Mon 11 Jan 2021 01:32:03 PM UTC, comment #3: 

i didn't have an easy repro.  it came up after composing an e-mail.  i probably invoked the speller multiple times, including on the whole file, and on just portions (using the mark function).

set speller "aspell -x -c"

Mike Frysinger <vapier>
Group Member
Mon 11 Jan 2021 01:07:01 PM UTC, comment #2: 

I cannot reproduce, not even after configuring nano with your ./configure command and rebuilding.

From the backtrace, it seems the crash occurred when you initiated a spell check (^T ^S).  But valgrind does not find any memory leak when I run a spell check on the README file (with --speller "aspell -x -c -l en" and nano configured by default).

What is 'set speller' set to in your .nanorc?  What kind of file were you spell checking?

Benno Schulenberg <bens>
Group administrator
Mon 11 Jan 2021 12:30:03 PM UTC, comment #1: 

./configure --prefix=/usr -C 'CFLAGS=-fsanitize=address -O0 -ggdb -pipe -g -march=native' --without-included-regex --datadir=/usr/share --sysconfdir=/etc --disable-dependency-tracking --disable-silent-rules --libdir=/usr/lib64 --bindir=/bin --enable-color --enable-multibuffer --enable-nanorc --enable-libmagic --enable-speller --disable-justify --disable-debug --enable-nls --enable-utf8 --disable-tiny

Mike Frysinger <vapier>
Group Member
Mon 11 Jan 2021 12:23:13 PM UTC, original submission:  

$ nano --version
 GNU nano from git, v5.4-62-gc53da9aa5bff
 (C) 1999-2011, 2013-2020 Free Software Foundation, Inc.
 (C) 2014-2020 the contributors to nano
 Compiled options: --disable-justify --enable-utf8

==26607==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 13 byte(s) in 1 object(s) allocated from:
    #0 0x7f9d288600e8 in __interceptor_malloc /var/tmp/portage/sys-devel/gcc-9.3.0-r2/work/gcc-9.3.0/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x55641eafa575 in nmalloc /usr/local/src/nano/src/utils.c:295
    #2 0x55641eafa692 in measured_copy /usr/local/src/nano/src/utils.c:337
    #3 0x55641eafa731 in copy_of /usr/local/src/nano/src/utils.c:348
    #4 0x55641eaf0e97 in construct_argument_list /usr/local/src/nano/src/text.c:2033
    #5 0x55641eaf17e0 in treat /usr/local/src/nano/src/text.c:2121
    #6 0x55641eaf4693 in do_spell /usr/local/src/nano/src/text.c:2537
    #7 0x55641eacec21 in do_statusbar_input /usr/local/src/nano/src/prompt.c:355
    #8 0x55641eacf909 in acquire_an_answer /usr/local/src/nano/src/prompt.c:465
    #9 0x55641ead0878 in do_prompt /usr/local/src/nano/src/prompt.c:608
    #10 0x55641eaa2fe9 in do_insertfile /usr/local/src/nano/src/files.c:1150
    #11 0x55641eaa3e21 in do_execute /usr/local/src/nano/src/files.c:1312
    #12 0x55641eac64ac in process_a_keystroke /usr/local/src/nano/src/nano.c:1625
    #13 0x55641eaccaa6 in main /usr/local/src/nano/src/nano.c:2544
    #14 0x7f9d284fbcfd in __libc_start_main ../csu/libc-start.c:308

Mike Frysinger <vapier>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by vapier (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-01-15 bens Open/ClosedOpen Closed
    2021-01-11 bens Severity3 - Normal 2 - Minor
        StatusNone Fixed
        Summarylsan reports a leak upon exit after doing spell checking 'lsan' reports a leak upon exit after doing spell checking
    2021-01-11 bens Summarylsan crash when editing file lsan reports a leak upon exit after doing spell checking
    2021-01-11 bens Assigned toNone bens

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code