bugGNU nano - Bugs: bug #62952, "Invalid read of size 8"...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #62952: "Invalid read of size 8" when undoing an <Enter> with --softwrap

Submitter:  Benno Schulenberg <bens>
Submitted:  Wed 24 Aug 2022 01:24:06 PM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Wed 24 Aug 2022 02:04:58 PM UTC, comment #2: 

Fixed in git, commit 9410a556, by simply setting 'openfile->current' to a valid value before calling goto_line_posx().

Benno Schulenberg <bens>
Group administrator
Wed 24 Aug 2022 01:32:50 PM UTC, comment #1: 

Bug exists since version 6.3, commit eea3e1f0: "make the triggering of the recalculation of multidata less eager".

The problem is that that change made goto_line_posx() refer to  'openfile->current'.  But this line could be no longer valid: freed during an undo or redo.

(The same invalid read can be obtained after running the same command as before and then typing: <End> <Delete> M-U <Down> M-E ^X ^Q.)

Bug was found while editing a long line and switching on softwrap (which I normally have off) and then hitting <Enter> followed by <Undo>, upon which nano aborted, because normally I have it compiled with '-fsanitize=address'.

Benno Schulenberg <bens>
Group administrator
Wed 24 Aug 2022 01:24:06 PM UTC, original submission:  

To reproduce, run:

valgrind src/nano --ignore --soft +,22 NEWS 2>TRAIL; cat TRAIL

Then type: <Enter> M-U ^X
Result:
==16632== Invalid read of size 8
==16632==    at 0x12D842: goto_line_posx (search.c:744)
==16632==    by 0x12F8EC: do_undo (text.c:543)
==16632==    by 0x12406C: process_a_keystroke (nano.c:1660)
==16632==    by 0x125CCB: main (nano.c:2597)
==16632==  Address 0x59af8a8 is 8 bytes inside a block of size 48 free'd
==16632==    at 0x4C32D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16632==    by 0x13FC1C: rpl_free (free.c:44)
==16632==    by 0x120F55: delete_node (nano.c:114)
==16632==    by 0x120FE2: unlink_node (nano.c:129)
==16632==    by 0x12F8C9: do_undo (text.c:541)
==16632==    by 0x12406C: process_a_keystroke (nano.c:1660)
==16632==    by 0x125CCB: main (nano.c:2597)
==16632==  Block was alloc'd at
==16632==    at 0x4C31B0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16632==    by 0x136B81: nmalloc (utils.c:288)
==16632==    by 0x120DF7: make_new_node (nano.c:69)
==16632==    by 0x1307B3: do_enter (text.c:858)
==16632==    by 0x12406C: process_a_keystroke (nano.c:1660)
==16632==    by 0x125CCB: main (nano.c:2597

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-11-16 bens Open/ClosedOpen Closed
    2022-08-24 bens StatusIn Progress Fixed

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code