bugGNU nano - Bugs: bug #60436, use-after-free detected when undo...


You are not allowed to post comments on this tracker with your current authentication level.

bug #60436: use-after-free detected when undo goes offscreen

Submitted by:  Benno Schulenberg <bens>
Submitted on:  Thu 22 Apr 2021 10:34:08 AM UTC  
Severity:  3 - Normal Status:  Fixed
Assigned to:  Benno Schulenberg <bens> Open/Closed:  Closed

Fri 23 Apr 2021 08:51:27 AM UTC, comment #2: 

Fixed in git, commit 588022ab, by stepping 'edittop' one line back in delete_node() when needed.

This burdens every node deletion with an additional check, but... it is needed in three places: undoing an ENTER, redoing a JOIN, and removing a magicline.  (The normal cutting of a line or a region checks whether edittop is affected, and adjusts it when needed, so in that case the stepping back is a superfluous action.)

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 22 Apr 2021 05:57:47 PM UTC, comment #1: 

Bug exists since version 2.3.3 from seven years ago.  :|

The offending commit is 60815461: "Going to the correct positions for undoing and redoing cuts and pastes.  This fixes many undo problems and Savannah bug #25585."  As a side effect this did not always center the cursor for every undo, meaning that the top line of the screen could now get deleted.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 22 Apr 2021 10:34:08 AM UTC, original submission:  

To reproduce, configure nano with CFLAGS="-g -O0 -fsanitize=address", compile, and then run:

src/nano --line --ignore 2>TRAIL

Then hold down <Enter> until the first few lines have scrolled offscreen.  Then hold down M-U until the cursor reaches the top row.  Then type one more M-U.  Result: nano is aborted:

==22705==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000005418 at pc 0x56402d8c81c0 bp 0x7ffd67b74cf0 sp 0x7ffd67b74ce0
READ of size 8 at 0x604000005418 thread T0
    #0 0x56402d8c81bf in current_is_above_screen /home/ben/Sources/NANO/src/winio.c:3304
    #1 0x56402d8c872f in current_is_offscreen /home/ben/Sources/NANO/src/winio.c:3333
    #2 0x56402d8c8d7d in edit_refresh /home/ben/Sources/NANO/src/winio.c:3391
    #3 0x56402d884179 in main /home/ben/Sources/NANO/src/nano.c:2517
    #4 0x7ff9ad538bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #5 0x56402d847989 in _start (/home/ben/Sources/NANO/src/nano+0x22989)

0x604000005418 is located 8 bytes inside of 48-byte region [0x604000005410,0x604000005440)
freed by thread T0 here:
    #0 0x7ff9ade3f7a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8)
    #1 0x56402d8cb61d in rpl_free /home/ben/Sources/NANO/lib/free.c:44
    #2 0x56402d8770e4 in delete_node /home/ben/Sources/NANO/src/nano.c:111
    #3 0x56402d8772d9 in unlink_node /home/ben/Sources/NANO/src/nano.c:126
    #4 0x56402d89d417 in do_undo /home/ben/Sources/NANO/src/text.c:541
    #5 0x56402d87e816 in process_a_keystroke /home/ben/Sources/NANO/src/nano.c:1616
    #6 0x56402d884289 in main /home/ben/Sources/NANO/src/nano.c:2531
    #7 0x7ff9ad538bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

The problem is that the undo at the top of the screen removes the line that 'edittop' refers to.  And to determine whether the cursor has gone offscreen, nano references 'edittop'...  Oops.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-04-30 bens Open/ClosedOpen => Closed
    2021-04-23 bens Severity4 - Important => 3 - Normal
        StatusIn Progress => Fixed
    2021-04-22 bens StatusNone => In Progress

    Back to the top

    Powered by Savane 3.7