bugGNU nano - Bugs: bug #61438, a full justification can result in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #61438: a full justification can result in a segfault

Submitter:  Benno Schulenberg <bens>
Submitted:  Sun 07 Nov 2021 02:05:08 PM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Thu 16 Dec 2021 10:04:36 AM UTC, comment #3: 

Fix was released in nano-6.0.

Benno Schulenberg <bens>
Group administrator
Sun 07 Nov 2021 02:28:25 PM UTC, comment #2: 

Fixed in git, commit 167c93b8, by checking that there is a preceding line, so that 'quote_length(line->prev->data)' will not dereference a NULL pointer.

Benno Schulenberg <bens>
Group administrator
Sun 07 Nov 2021 02:08:06 PM UTC, comment #1: 

The output from ASAN:

==3999==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x560c1bad646b bp 0x7ffd15aecf50 sp 0x7ffd15aecf10 T0)
==3999==The signal is caused by a READ memory access.
==3999==Hint: address points to the zero page.
    #0 0x560c1bad646a in begpar /home/ben/Sources/NANO/src/text.c:1489
    #1 0x560c1bad670a in begpar /home/ben/Sources/NANO/src/text.c:1505
    #2 0x560c1bad670a in begpar /home/ben/Sources/NANO/src/text.c:1505
    #3 0x560c1bad670a in begpar /home/ben/Sources/NANO/src/text.c:1505
    #4 0x560c1baa399a in do_para_end /home/ben/Sources/NANO/src/move.c:194
    #5 0x560c1bad6a2e in find_paragraph /home/ben/Sources/NANO/src/text.c:1532
    #6 0x560c1bada2ae in justify_text /home/ben/Sources/NANO/src/text.c:1935
    #7 0x560c1bada914 in do_full_justify /home/ben/Sources/NANO/src/text.c:1999
    #8 0x560c1baaf579 in process_a_keystroke /home/ben/Sources/NANO/src/nano.c:1634
    #9 0x560c1bab53a7 in main /home/ben/Sources/NANO/src/nano.c:2561
    #10 0x7f8484eefbf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #11 0x560c1ba77b89 in _start (/home/ben/Sources/NANO/src/nano+0x22b89)

Benno Schulenberg <bens>
Group administrator
Sun 07 Nov 2021 02:05:08 PM UTC, original submission:  

To reproduce, run:

src/nano --ignore --fill=144 NEWS

Then type: M-J
Result: nano crashes.

(Bug was found on NomadBSD, where the fullscreen terminal emulator is 151 columns wide.  On my normal machine, the maximum terminal width is 135 columns, and without a --fill option that is not enough to trigger the issue.)

Bug existed since version 4.0, since David overhauled the justifying code and made justifications undoable.  The offending commit is 14c08589: "make do_justify() use the cutbuffer".

The problem is that begpar() checks whether the given line equals openfile->filetop...  But when the text to be justified is in the cutbuffer, one should not compare any of its lines to a line in the actual file buffer, as they will never match.  :|

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-12-16 bens Open/ClosedOpen Closed
    2021-11-07 bens StatusIn Progress Fixed
    2021-11-07 bens StatusNone In Progress

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code