bugGNU nano - Bugs: bug #60764, heap buffer overflow when toggling...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60764: heap buffer overflow when toggling "pipe" twice

Submitter:  Benno Schulenberg <bens>
Submitted:  Thu 10 Jun 2021 09:15:04 AM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Thu 10 Jun 2021 09:42:20 AM UTC, comment #3: 

Fixed in git, commit d7e32261, by moving one byte less.

Benno Schulenberg <bens>
Group administrator
Thu 10 Jun 2021 09:33:18 AM UTC, comment #2: 

The problem is that when wanting to remove the "|", we want to reduce the size of the answer by one byte, so we should not move strlen(answer) + 1 bytes (the full answer plus the nul byte), but just strlen(answer) (the answer minus the leading "|" plus the terminating nul byte).

The offending commit is f304b9ae from three years ago.  So the bug exists since version 2.9.8, "Espresso", that introduced piping text to a command.

Benno Schulenberg <bens>
Group administrator
Thu 10 Jun 2021 09:20:07 AM UTC, comment #1: 

A similar recipe (^T M-\ M-\ ^C ^X) in valgrind gives this:

==13782== Invalid read of size 1
==13782==    at 0x4C36108: memcpy@GLIBC_2.2.5 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==13782==    by 0x12204F: memmove (string_fortified.h:40)
==13782==    by 0x12204F: add_or_remove_pipe_symbol_from_answer (prompt.c:429)
==13782==    by 0x1161D4: do_insertfile (files.c:1209)
==13782==    by 0x120F5B: process_a_keystroke (nano.c:1619)
==13782==    by 0x10E16E: main (nano.c:2535)
==13782==  Address 0x5934622 is 0 bytes after a block of size 2 alloc'd
==13782==    at 0x4C33D2F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==13782==    by 0x12E9ED: nrealloc (utils.c:304)
==13782==    by 0x12EA50: mallocstrcpy (utils.c:321)
==13782==    by 0x122486: do_prompt (prompt.c:596)
==13782==    by 0x115E2C: do_insertfile (files.c:1159)
==13782==    by 0x120F5B: process_a_keystroke (nano.c:1619)
==13782==    by 0x10E16E: main (nano.c:2535)

Benno Schulenberg <bens>
Group administrator
Thu 10 Jun 2021 09:15:04 AM UTC, original submission:  

To reproduce, configire nano with CFLAGS="-g -O0 -fsanitize=address", compile, and then run:

src/nano --ignore README 2>TRAIL;
stty sane; nano --ignore;
less TRAIL

Then type: ^T M-\ M-\
Nano has aborted.  Type ^X to exit to a sane terminal and see the report of the abort:

=================================================================
==8340==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001592 at pc 0x7f0bef2c6deb bp 0x7ffdac40c840 sp 0x7ffdac40bfe8
READ of size 2 at 0x602000001592 thread T0
    #0 0x7f0bef2c6dea in __interceptor_memmove (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x7adea)
    #1 0x564d877f3a23 in add_or_remove_pipe_symbol_from_answer /home/ben/Sources/NANO/src/prompt.c:429
    #2 0x564d877caf4d in do_insertfile /home/ben/Sources/NANO/src/files.c:1209
    #3 0x564d877cb81b in do_execute /home/ben/Sources/NANO/src/files.c:1318
    #4 0x564d877eb69b in process_a_keystroke /home/ben/Sources/NANO/src/nano.c:1619
    #5 0x564d877f12d2 in main /home/ben/Sources/NANO/src/nano.c:2535
    #6 0x7f0beea23bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #7 0x564d877b47a9 in _start (/home/ben/Sources/NANO/src/nano+0x227a9)

0x602000001592 is located 0 bytes to the right of 2-byte region [0x602000001590,0x602000001592)
allocated by thread T0 here:
    #0 0x7f0bef32af30 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x564d8781ec7e in nrealloc /home/ben/Sources/NANO/src/utils.c:304
    #2 0x564d8781ecf7 in mallocstrcpy /home/ben/Sources/NANO/src/utils.c:321
    #3 0x564d877f4891 in do_prompt /home/ben/Sources/NANO/src/prompt.c:596
    #4 0x564d877cac2b in do_insertfile /home/ben/Sources/NANO/src/files.c:1159
    #5 0x564d877cb81b in do_execute /home/ben/Sources/NANO/src/files.c:1318
    #6 0x564d877eb69b in process_a_keystroke /home/ben/Sources/NANO/src/nano.c:1619
    #7 0x564d877f12d2 in main /home/ben/Sources/NANO/src/nano.c:2535
    #8 0x7f0beea23bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-06-16 bens Open/ClosedOpen Closed
    2021-06-10 bens StatusIn Progress Fixed
    2021-06-10 bens StatusNone In Progress

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code