bugGNU nano - Bugs: bug #65278, nano crashes in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65278: nano crashes in inject_into_answer() after a nested search

Submitter:  correctmost <correctmost>
Submitted:  Fri 09 Feb 2024 04:40:52 AM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Open

Sun 11 Feb 2024 03:12:45 PM UTC, comment #3: 

Fixed in git, commit 206b4e2a, by restoring 'typing_x' also for a ^V and ^Y at a Search prompt in the help viewer.

(Follow-up commit 20692e0c then does the same for a Search prompt in the browser.)

Benno Schulenberg <bens>
Group administrator
Sun 11 Feb 2024 10:40:00 AM UTC, comment #2: 

Without using ASAN or running nano in valgrind, an actual crash happens when running `src/nano --ignore` and typing:

^F ^G ^F a ^V ^C b n m

Result: "Sorry! Nano crashed!  Code: 6.  Please report a bug."

Or: "realloc(): invalid next size" plus a segfault.

Benno Schulenberg <bens>
Group administrator
Sun 11 Feb 2024 07:55:17 AM UTC, comment #1: 

Thanks for reporting, and for the clear recipe.

The recipe can be made a little shorter, as the combination "Ctrl+F Enter" appears to be redundant.

The shorter recipe then is: run `src/nano --ignore` and then type:

^F ^G ^F a ^V ^C b n

In valgrind this produces:

==2605== Invalid read of size 1
==2605==    at 0x4852A10: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==2605==    by 0x12933C: inject_into_answer (prompt.c:226)
==2605==    by 0x129559: absorb_character (prompt.c:284)
==2605==    by 0x129C21: acquire_an_answer (prompt.c:466)
==2605==    by 0x12A1A2: do_prompt (prompt.c:596)
==2605==    by 0x12F586: search_init (search.c:96)
==2605==    by 0x12FDA1: do_search_forward (search.c:352)
==2605==    by 0x126D0F: process_a_keystroke (nano.c:1685)
==2605==    by 0x128B3C: main (nano.c:2651)
==2605==  Address 0x4bbcad2 is 0 bytes after a block of size 2 alloc'd
==2605==    at 0x484DCD3: realloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==2605==    by 0x13A181: nrealloc (utils.c:304)
==2605==    by 0x1292E4: inject_into_answer (prompt.c:225)
==2605==    by 0x129559: absorb_character (prompt.c:284)
==2605==    by 0x129C21: acquire_an_answer (prompt.c:466)
==2605==    by 0x12A1A2: do_prompt (prompt.c:596)
==2605==    by 0x12F586: search_init (search.c:96)
==2605==    by 0x12FDA1: do_search_forward (search.c:352)
==2605==    by 0x126D0F: process_a_keystroke (nano.c:1685)
==2605==    by 0x128B3C: main (nano.c:2651)
==2605==
==2605== Invalid write of size 1
==2605==    at 0x4852A13: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==2605==    by 0x12933C: inject_into_answer (prompt.c:226)
==2605==    by 0x129559: absorb_character (prompt.c:284)
==2605==    by 0x129C21: acquire_an_answer (prompt.c:466)
==2605==    by 0x12A1A2: do_prompt (prompt.c:596)
==2605==    by 0x12F586: search_init (search.c:96)
==2605==    by 0x12FDA1: do_search_forward (search.c:352)
==2605==    by 0x126D0F: process_a_keystroke (nano.c:1685)
==2605==    by 0x128B3C: main (nano.c:2651)
==2605==  Address 0x4bbcad3 is 1 bytes after a block of size 2 alloc'd
==2605==    at 0x484DCD3: realloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==2605==    by 0x13A181: nrealloc (utils.c:304)
==2605==    by 0x1292E4: inject_into_answer (prompt.c:225)
==2605==    by 0x129559: absorb_character (prompt.c:284)
==2605==    by 0x129C21: acquire_an_answer (prompt.c:466)
==2605==    by 0x12A1A2: do_prompt (prompt.c:596)
==2605==    by 0x12F586: search_init (search.c:96)
==2605==    by 0x12FDA1: do_search_forward (search.c:352)
==2605==    by 0x126D0F: process_a_keystroke (nano.c:1685)
==2605==    by 0x128B3C: main (nano.c:2651)
==2605==
==2605== Invalid read of size 1
==2605==    at 0x4852A1D: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==2605==    by 0x12933C: inject_into_answer (prompt.c:226)
==2605==    by 0x129559: absorb_character (prompt.c:284)
==2605==    by 0x129C21: acquire_an_answer (prompt.c:466)
==2605==    by 0x12A1A2: do_prompt (prompt.c:596)
==2605==    by 0x12F586: search_init (search.c:96)
==2605==    by 0x12FDA1: do_search_forward (search.c:352)
==2605==    by 0x126D0F: process_a_keystroke (nano.c:1685)
==2605==    by 0x128B3C: main (nano.c:2651)
==2605==  Address 0x4bbcad4 is 2 bytes after a block of size 2 alloc'd
==2605==    at 0x484DCD3: realloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==2605==    by 0x13A181: nrealloc (utils.c:304)
==2605==    by 0x1292E4: inject_into_answer (prompt.c:225)
==2605==    by 0x129559: absorb_character (prompt.c:284)
==2605==    by 0x129C21: acquire_an_answer (prompt.c:466)
==2605==    by 0x12A1A2: do_prompt (prompt.c:596)
==2605==    by 0x12F586: search_init (search.c:96)
==2605==    by 0x12FDA1: do_search_forward (search.c:352)
==2605==    by 0x126D0F: process_a_keystroke (nano.c:1685)
==2605==    by 0x128B3C: main (nano.c:2651)


(Note that the b never appears at the prompt.)

Benno Schulenberg <bens>
Group administrator
Fri 09 Feb 2024 04:40:52 AM UTC, original submission:  

Steps to reproduce:
01 - Ctrl + f
02 - Ctrl + g
03 - Ctrl + f
04 - Type a
05 - Ctrl + v
06 - Ctrl + f
07 - Press enter
08 - Type x
09 - Type a
10 - Type a

Backtrace:

=================================================================
==135457==ERROR: AddressSanitizer: negative-size-param: (size=-1)
    #0 0x5c20e13641f9 in __asan_memmove (/usr/local/bin/nano+0x17e1f9)
    #1 0x5c20e1400a5b in inject_into_answer /home/s/code/nano/src/prompt.c:226:2
    #2 0x5c20e1400cf6 in absorb_character /home/s/code/nano/src/prompt.c:284:3
    #3 0x5c20e1401f8e in acquire_an_answer /home/s/code/nano/src/prompt.c:466:3
    #4 0x5c20e1402abe in do_prompt /home/s/code/nano/src/prompt.c:596:13
    #5 0x5c20e140d99f in search_init /home/s/code/nano/src/search.c:96:18
    #6 0x5c20e13f99cd in process_a_keystroke /home/s/code/nano/src/nano.c:1685:2
    #7 0x5c20e13fdf93 in main /home/s/code/nano/src/nano.c:2651:3
    #8 0x7f46597e8ccf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #9 0x7f46597e8d89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #10 0x5c20e12770b4 in _start (/usr/local/bin/nano+0x910b4)

0x5020000016f2 is located 0 bytes after 2-byte region [0x5020000016f0,0x5020000016f2)
allocated by thread T0 here:
    #0 0x5c20e13649ea in __interceptor_realloc.part.0 (/usr/local/bin/nano+0x17e9ea)
    #1 0x5c20e142a64a in nrealloc /home/s/code/nano/src/utils.c:304:12
    #2 0x5c20e1400a19 in inject_into_answer /home/s/code/nano/src/prompt.c:225:11
    #3 0x5c20e1400cf6 in absorb_character /home/s/code/nano/src/prompt.c:284:3
    #4 0x5c20e1401f8e in acquire_an_answer /home/s/code/nano/src/prompt.c:466:3
    #5 0x5c20e1402abe in do_prompt /home/s/code/nano/src/prompt.c:596:13
    #6 0x5c20e140d99f in search_init /home/s/code/nano/src/search.c:96:18
    #7 0x5c20e13f99cd in process_a_keystroke /home/s/code/nano/src/nano.c:1685:2
    #8 0x5c20e13fdf93 in main /home/s/code/nano/src/nano.c:2651:3
    #9 0x7f46597e8ccf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #10 0x7f46597e8d89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #11 0x5c20e12770b4 in _start (/usr/local/bin/nano+0x910b4)

SUMMARY: AddressSanitizer: negative-size-param (/usr/local/bin/nano+0x17e1f9)
==135457==ABORTING
Sorry! Nano crashed!  Code: 6.  Please report a bug.


Version: a0eebf20db7b00a50e5fabd36961dba2e81edf8e

correctmost <correctmost>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by correctmost (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-02-11 bens StatusNone Fixed
    2024-02-11 bens SummaryCrash in inject_into_answer with nested searches nano crashes in inject_into_answer() after a nested search
    2024-02-11 bens Assigned toNone bens

    Back to the top

    Powered by Savane 3.13.
    Corresponding source code