bugGNU nano - Bugs: bug #60537, nano crashes when terminal is...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60537: nano crashes when terminal is resized while linter is running

Submitter:  Filips Romāns <fjr>
Submitted:  Thu 06 May 2021 09:16:21 AM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Jump to the original submission

Wed 16 Jun 2021 09:33:52 AM UTC, comment #8: 

The fix was released in nano-5.8.  Thanks again for reporting!

Benno Schulenberg <bens>
Group administrator
Thu 06 May 2021 12:43:04 PM UTC, comment #7: 

I ran into this when I used a linter for Java (which takes quite a few milliseconds) and split my Tmux pane at the same time.

Filips Romāns <fjr>
Thu 06 May 2021 11:35:26 AM UTC, comment #6: 

Fixed in git, commit 4712d464, by blocking SIGWINCH at the right moment.

Thanks again for reporting.  Out of curiosity: did you actually run into this, or did you look at the code and see the problem?

Benno Schulenberg <bens>
Group administrator
Thu 06 May 2021 11:24:35 AM UTC, comment #5: 

The problem is the same as it was with bug #56011 from two years ago: the signal causes read() to return.  (But how this can lead to 'pointer' taking a step backwards, I don't understand.)

Anyway, the solution is the same as it was then: block the SIGWINCHes while reading from the pipe.  This should have been done as part of fixing bug #56011, as the code of do_linter() was modelled on do_int_speller().

Benno Schulenberg <bens>
Group administrator
Thu 06 May 2021 10:50:34 AM UTC, comment #4: 

Running the recipe with valgrind gives:

==9179== Syscall param read(buf) points to unaddressable byte(s)
==9179==    at 0x53A7151: read (read.c:27)
==9179==    by 0x12C90A: read (unistd.h:44)
==9179==    by 0x12C90A: do_linter (text.c:2619)
==9179==    by 0x11F4A3: process_a_keystroke (nano.c:1619)
==9179==    by 0x120B82: main (nano.c:2534)
==9179==  Address 0x5a2df5f is 1 bytes before a block of size 8,193 alloc'd
==9179==    at 0x4C33D2F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9179==    by 0x12DEB2: nrealloc (utils.c:304)
==9179==    by 0x12C8F4: do_linter (text.c:2622)
==9179==    by 0x11F4A3: process_a_keystroke (nano.c:1619)
==9179==    by 0x120B82: main (nano.c:2534)

Benno Schulenberg <bens>
Group administrator
Thu 06 May 2021 10:47:29 AM UTC, comment #3: 

Compiling with -fsanitizer=address produces:

==8975==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62c0000001fa at pc 0x7f1a23a250a>
WRITE of size 19 at 0x62c0000001fa thread T0
    #0 0x7f1a23a250ad  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x4e0ad)
    #1 0x5615c86069b9 in do_linter /home/ben/Sources/NANO/src/text.c:2634
    #2 0x5615c85d7a35 in process_a_keystroke /home/ben/Sources/NANO/src/nano.c:1619
    #3 0x5615c85dd4f1 in main /home/ben/Sources/NANO/src/nano.c:2534
    #4 0x7f1a231aebf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #5 0x5615c85a0af9 in _start (/usr/local/bin/nano+0x22af9)

Benno Schulenberg <bens>
Group administrator
Thu 06 May 2021 10:41:09 AM UTC, comment #2: 

Oh, wait, I misunderstood.  It is the 'sleep 5' that is the key element.  With a little script like this:

#!/bin/sh
sleep 7;  echo README:7: oops

and then resizing while the linting script is busy sleeping, I can now reproduce the crash: when the sleep finishes and nano wants to continue.

Benno Schulenberg <bens>
Group administrator
Thu 06 May 2021 10:17:00 AM UTC, comment #1: 

Thanks for reporting.  However, I cannot reproduce.

At the end of my ~/.nanorc I've added:

extendsyntax default linter "echo 'README:7: mistake'"

Then I ran 'src/nano +1 README' and typed M-B to invoke the linter.  The cursor is put on line 7 and the status bar says: [ "README:7: mistake" README ].  Then I've tried resizing the terminal in various ways, but nothing happens: nano keeps on running and waiting for input, and I can exit normally (^C ^X).

Can you reproduce it with the above recipe?

How did you configure nano?  Please paste the output of './config.status --config'.  What terminal do you use?

Benno Schulenberg <bens>
Group administrator
Thu 06 May 2021 09:16:21 AM UTC, original submission:  

Tested with fresh build of version 5.7 and trivial nanorc. When the linter produces at least one message and the terminal is resized while the linter is running, nano will crash with the following message:

> Sorry! Nano crashed!  Code: 6.  Please report a bug.


For testing, I used the following "linter" script:

sleep 5
echo 'File.java:2: error'

Filips Romāns <fjr>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by fjr (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-06-16 bens Open/ClosedOpen Closed
    2021-05-06 bens StatusIn Progress Fixed
    2021-05-06 bens StatusNone In Progress
        SummaryNano crashes with code 6 when terminal resized during linter nano crashes when terminal is resized while linter is running
    2021-05-06 bens StatusNeed Info None
    2021-05-06 bens Severity3 - Normal 4 - Important
        StatusNone Need Info
        Assigned toNone bens

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code