bugGNU nano - Bugs: bug #60537, nano crashes when terminal is...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60537: nano crashes when terminal is resized while linter is running

Submitted by:  Filips Romāns <fjr>
Submitted on:  Thu 06 May 2021 09:16:21 AM UTC  
 
Severity:  4 - Important Status:  Fixed
Assigned to:  Benno Schulenberg <bens> Open/Closed:  Closed

( Jump to the original submission)

Wed 16 Jun 2021 09:33:52 AM UTC, comment #8: 

The fix was released in nano-5.8.  Thanks again for reporting!

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 06 May 2021 12:43:04 PM UTC, comment #7: 

I ran into this when I used a linter for Java (which takes quite a few milliseconds) and split my Tmux pane at the same time.

Filips Romāns <fjr>
Thu 06 May 2021 11:35:26 AM UTC, comment #6: 

Fixed in git, commit 4712d464, by blocking SIGWINCH at the right moment.

Thanks again for reporting.  Out of curiosity: did you actually run into this, or did you look at the code and see the problem?

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 06 May 2021 11:24:35 AM UTC, comment #5: 

The problem is the same as it was with bug #56011 from two years ago: the signal causes read() to return.  (But how this can lead to 'pointer' taking a step backwards, I don't understand.)

Anyway, the solution is the same as it was then: block the SIGWINCHes while reading from the pipe.  This should have been done as part of fixing bug #56011, as the code of do_linter() was modelled on do_int_speller().

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 06 May 2021 10:50:34 AM UTC, comment #4: 

Running the recipe with valgrind gives:

==9179== Syscall param read(buf) points to unaddressable byte(s)
==9179==    at 0x53A7151: read (read.c:27)
==9179==    by 0x12C90A: read (unistd.h:44)
==9179==    by 0x12C90A: do_linter (text.c:2619)
==9179==    by 0x11F4A3: process_a_keystroke (nano.c:1619)
==9179==    by 0x120B82: main (nano.c:2534)
==9179==  Address 0x5a2df5f is 1 bytes before a block of size 8,193 alloc'd
==9179==    at 0x4C33D2F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9179==    by 0x12DEB2: nrealloc (utils.c:304)
==9179==    by 0x12C8F4: do_linter (text.c:2622)
==9179==    by 0x11F4A3: process_a_keystroke (nano.c:1619)
==9179==    by 0x120B82: main (nano.c:2534)

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 06 May 2021 10:47:29 AM UTC, comment #3: 

Compiling with -fsanitizer=address produces:

==8975==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62c0000001fa at pc 0x7f1a23a250a>
WRITE of size 19 at 0x62c0000001fa thread T0
    #0 0x7f1a23a250ad  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x4e0ad)
    #1 0x5615c86069b9 in do_linter /home/ben/Sources/NANO/src/text.c:2634
    #2 0x5615c85d7a35 in process_a_keystroke /home/ben/Sources/NANO/src/nano.c:1619
    #3 0x5615c85dd4f1 in main /home/ben/Sources/NANO/src/nano.c:2534
    #4 0x7f1a231aebf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #5 0x5615c85a0af9 in _start (/usr/local/bin/nano+0x22af9)

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 06 May 2021 10:41:09 AM UTC, comment #2: 

Oh, wait, I misunderstood.  It is the 'sleep 5' that is the key element.  With a little script like this:

#!/bin/sh
sleep 7;  echo README:7: oops

and then resizing while the linting script is busy sleeping, I can now reproduce the crash: when the sleep finishes and nano wants to continue.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 06 May 2021 10:17:00 AM UTC, comment #1: 

Thanks for reporting.  However, I cannot reproduce.

At the end of my ~/.nanorc I've added:

extendsyntax default linter "echo 'README:7: mistake'"

Then I ran 'src/nano +1 README' and typed M-B to invoke the linter.  The cursor is put on line 7 and the status bar says: [ "README:7: mistake" README ].  Then I've tried resizing the terminal in various ways, but nothing happens: nano keeps on running and waiting for input, and I can exit normally (^C ^X).

Can you reproduce it with the above recipe?

How did you configure nano?  Please paste the output of './config.status --config'.  What terminal do you use?

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Thu 06 May 2021 09:16:21 AM UTC, original submission:  

Tested with fresh build of version 5.7 and trivial nanorc. When the linter produces at least one message and the terminal is resized while the linter is running, nano will crash with the following message:

> Sorry! Nano crashed!  Code: 6.  Please report a bug.


For testing, I used the following "linter" script:

sleep 5
echo 'File.java:2: error'

Filips Romāns <fjr>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by fjr (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-06-16 bens Open/ClosedOpen => Closed
    2021-05-06 bens StatusIn Progress => Fixed
    2021-05-06 bens StatusNone => In Progress
        SummaryNano crashes with code 6 when terminal resized during linter => nano crashes when terminal is resized while linter is running
    2021-05-06 bens StatusNeed Info => None
    2021-05-06 bens Severity3 - Normal => 4 - Important
        StatusNone => Need Info
        Assigned toNone => bens

    Back to the top


    Powered by Savane 3.6