bugGNU nano - Bugs: bug #60853, nano spirals to a segfault when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60853: nano spirals to a segfault when dying on an unwritable file

Submitter:  Benno Schulenberg <bens>
Submitted:  Tue 29 Jun 2021 10:47:34 AM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Thu 07 Oct 2021 07:28:55 AM UTC, comment #2: 

Released in nano-5.9.

Benno Schulenberg <bens>
Group administrator
Tue 29 Jun 2021 12:41:07 PM UTC, comment #1: 

Fixed in git, commit fc01c5a1, by not calling die() in statusline().

The thing that triggered the original bug report ("Too many errors from stdin") is mitigated by the subsequent commit, 8d1a666d, by increasing the error-count value to twelve million (which takes 40 seconds to reach on my slow machine, and 8 seconds on a faster one), so that the user stands a chance to type something before the die() is triggered when wgetch() mistakenly starts returning ERR.  Hopefully that keystroke will make wgetch() behave correctly again.

Benno Schulenberg <bens>
Group administrator
Tue 29 Jun 2021 10:47:34 AM UTC, original submission:  

To reproduce, first apply the attached patch in order to be able to produce the death by "Too many errors from stdin" manually (by typing ^L).  Compile, and then run nano as a normal user on a file in a directory that is only writable by root.  For example:

src/nano --ignore /etc/crontab

Then type: xxx ^L
Result: an endless stream of "Out of curses -- please report a bug" messages is printed, followed by a segmentation fault.

The problem is that when nano dies and the target directory is not writable, the write_file() function that is indirectly called from die() tries to write an error message to the status bar, but the restore_terminal() call has exited from ncurses, so this attempted error message causes another call of die() with "Out of curses", which causes indirectly another call to write_file(), which fails because the directory is not writable and tries to write an error message to the status bar...  Endless recursion until the stack overflows.  :|

The straightforward fix is not to call die() in statusline() but to simply return without showing any message.

The original report is in https://bugzilla.redhat.com/1976410 -- the two backtraces gave enough information to figure out what had happened.

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #51623:  death-by-control-L.patch added by bens (513B - text/x-patch - allow triggering a call of die() by typing ^L)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-10-07 bens Open/ClosedOpen Closed
    2021-06-29 bens StatusNone Fixed
    2021-06-29 bens Attached File- Added death-by-control-L.patch, #51623

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code