bugGNU nano - Bugs: bug #61438, a full justification can result in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #61438: a full justification can result in a segfault

Submitted by:  Benno Schulenberg <bens>
Submitted on:  Sun 07 Nov 2021 02:05:08 PM UTC  
 
Severity:  4 - Important Status:  Fixed
Assigned to:  Benno Schulenberg <bens> Open/Closed:  Open

Sun 07 Nov 2021 02:28:25 PM UTC, comment #2: 

Fixed in git, commit 167c93b8, by checking that there is a preceding line, so that 'quote_length(line->prev->data)' will not dereference a NULL pointer.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Sun 07 Nov 2021 02:08:06 PM UTC, comment #1: 

The output from ASAN:

==3999==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x560c1bad646b bp 0x7ffd15aecf50 sp 0x7ffd15aecf10 T0)
==3999==The signal is caused by a READ memory access.
==3999==Hint: address points to the zero page.
    #0 0x560c1bad646a in begpar /home/ben/Sources/NANO/src/text.c:1489
    #1 0x560c1bad670a in begpar /home/ben/Sources/NANO/src/text.c:1505
    #2 0x560c1bad670a in begpar /home/ben/Sources/NANO/src/text.c:1505
    #3 0x560c1bad670a in begpar /home/ben/Sources/NANO/src/text.c:1505
    #4 0x560c1baa399a in do_para_end /home/ben/Sources/NANO/src/move.c:194
    #5 0x560c1bad6a2e in find_paragraph /home/ben/Sources/NANO/src/text.c:1532
    #6 0x560c1bada2ae in justify_text /home/ben/Sources/NANO/src/text.c:1935
    #7 0x560c1bada914 in do_full_justify /home/ben/Sources/NANO/src/text.c:1999
    #8 0x560c1baaf579 in process_a_keystroke /home/ben/Sources/NANO/src/nano.c:1634
    #9 0x560c1bab53a7 in main /home/ben/Sources/NANO/src/nano.c:2561
    #10 0x7f8484eefbf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #11 0x560c1ba77b89 in _start (/home/ben/Sources/NANO/src/nano+0x22b89)

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Sun 07 Nov 2021 02:05:08 PM UTC, original submission:  

To reproduce, run:

src/nano --ignore --fill=144 NEWS

Then type: M-J
Result: nano crashes.

(Bug was found on NomadBSD, where the fullscreen terminal emulator is 151 columns wide.  On my normal machine, the maximum terminal width is 135 columns, and without a --fill option that is not enough to trigger the issue.)

Bug existed since version 4.0, since David overhauled the justifying code and made justifications undoable.  The offending commit is 14c08589: "make do_justify() use the cutbuffer".

The problem is that begpar() checks whether the given line equals openfile->filetop...  But when the text to be justified is in the cutbuffer, one should not compare any of its lines to a line in the actual file buffer, as they will never match.  :|

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-11-07 bens StatusIn Progress => Fixed
    2021-11-07 bens StatusNone => In Progress

    Back to the top


    Powered by Savane 3.7