bugGNU nano - Bugs: bug #63120, current git can crash when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #63120: current git can crash when filtering shortens the buffer

Submitter:  Benno Schulenberg <bens>
Submitted:  Wed 28 Sep 2022 10:04:13 AM UTC
   
 
Severity:  5 - Blocker Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Fri 30 Sep 2022 09:30:38 AM UTC, comment #1: 

Fixed in git, commit d4d2840f, by checking that the line number given to goto_line_posx() is within range (less than the line number of the last line in the buffer) before calling line_from_number().

And closing because unreleased.

Benno Schulenberg <bens>
Group administrator
Wed 28 Sep 2022 10:04:13 AM UTC, original submission:  

To reproduce, run:

src/nano +22 README

Then type: ^T | sed '11,$d' <Enter>
Result: nano crashes.

What happens is that the 'sed' command makes the buffer shorter than the current line number, and afterwards nano tries to go back to that old line number, calling goto_line_posx(), resulting in line_from_number() overrunning the end of the buffer and trying to dereference NULL.  Oops.

The offending commit is d1e28417: "move to a given line number more efficiently".  It is more efficient (on average), but normally the line number that is passed to goto_line_posx() always exists, because most uses of this function are in the undo/redo code, that restores or redoes things on lines and data and numbers that necessarily must exist.

Another way to trigger the bug is:

src/nano --fill=444 +88 README

And then type: M-J

The same thing happens: the Full Justify makes the buffer shorter than 88 lines, and when trying to go back to line 88...  Boom.

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-09-30 bens StatusIn Progress Fixed
        Open/ClosedOpen Closed
    2022-09-28 bens StatusNone In Progress

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code