bugGNU nano - Bugs: bug #65289, heap-buffer-overflow in copy_of()...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65289: heap-buffer-overflow in copy_of() when undoing a full justification

Submitter:  correctmost <correctmost>
Submitted:  Sat 10 Feb 2024 06:23:37 PM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Thu 02 May 2024 05:37:15 AM UTC, comment #3: 

The fix was released in nano-8.0.  Thanks again for reporting.

 Benno Schulenberg <bens>
Group administrator
Sun 11 Feb 2024 03:37:04 PM UTC, comment #2: 

Fixed in git, commit 0e44752b, by effectively reverting 2500debb, that is: by setting 'current_x' to zero when doing a full justification, so that extract_segment() will do the right thing.

 Benno Schulenberg <bens>
Group administrator
Sun 11 Feb 2024 03:22:00 PM UTC, comment #1: 

Thanks for reporting!

Concentrating the recipe more on visible misbehavior:

run `src/nano --ignore --cutfrom` and type:

aaaaa M-J M-U

See that the status bar says "Undid justification", but the five a's have disappeared!  Oops.

Bug exists since version 4.0, commit 2500debb: "don't bother zeroing the x position when doing a full justify".  But the x position does matter when --cutfromcursor is active.  Ouch!

Benno Schulenberg <bens>
Group administrator
Sat 10 Feb 2024 06:23:37 PM UTC, original submission:  

Steps to reproduce:
1 - Start nano
2 - Alt + k
3 - Type a
4 - Alt + j
5 - Alt + u
--> You may have to run with Valgrind or AddressSanitizer to see the memory error

Backtrace:


ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000001391 at pc 0x61610ef13dd5 bp 0x7ffe2e48c230 sp 0x7ffe2e48b9f0
READ of size 1 at 0x502000001391 thread T0
    #0 0x61610ef13dd4 in __interceptor_strlen.part.0 (/usr/local/bin/nano+0xdfdd4)
    #1 0x61610f0775a2 in copy_of /home/s/code/nano/src/utils.c:339:31
    #2 0x61610f0080ae in ingraft_buffer /home/s/code/nano/src/cut.c:375:19
    #3 0x61610f0087ec in copy_from_buffer /home/s/code/nano/src/cut.c:450:2
    #4 0x61610f065a64 in undo_cut /home/s/code/nano/src/text.c:464:3
    #5 0x61610f066279 in do_undo /home/s/code/nano/src/text.c
    #6 0x61610f06603f in do_undo /home/s/code/nano/src/text.c:629:3
    #7 0x61610f0479cd in process_a_keystroke /home/s/code/nano/src/nano.c:1685:2
    #8 0x61610f04bf93 in main /home/s/code/nano/src/nano.c:2651:3
    #9 0x735fc7ea4ccf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #10 0x735fc7ea4d89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #11 0x61610eec50b4 in _start (/usr/local/bin/nano+0x910b4)

0x502000001391 is located 0 bytes after 1-byte region [0x502000001390,0x502000001391)
allocated by thread T0 here:
    #0 0x61610efb29ea in __interceptor_realloc.part.0 (/usr/local/bin/nano+0x17e9ea)
    #1 0x61610f07864a in nrealloc /home/s/code/nano/src/utils.c:304:12
    #2 0x61610f0083c1 in ingraft_buffer /home/s/code/nano/src/cut.c:414:19
    #3 0x61610f070564 in justify_text /home/s/code/nano/src/text.c:1967:2
    #4 0x61610f07101d in do_full_justify /home/s/code/nano/src/text.c:2015:2
    #5 0x61610f0479cd in process_a_keystroke /home/s/code/nano/src/nano.c:1685:2
    #6 0x61610f04bf93 in main /home/s/code/nano/src/nano.c:2651:3
    #7 0x735fc7ea4ccf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x735fc7ea4d89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #9 0x61610eec50b4 in _start (/usr/local/bin/nano+0x910b4)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/local/bin/nano+0xdfdd4)
Shadow bytes around the buggy address:
  0x502000001100: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa fd fa
  0x502000001180: fa fa fd fa fa fa 01 fa fa fa fd fa fa fa 00 04
  0x502000001200: fa fa fd fa fa fa fd fa fa fa 02 fa fa fa 00 06
  0x502000001280: fa fa fd fa fa fa 02 fa fa fa 01 fa fa fa fd fa
  0x502000001300: fa fa 02 fa fa fa 01 fa fa fa fd fa fa fa fd fa
=>0x502000001380: fa fa[01]fa fa fa 00 06 fa fa fd fa fa fa 02 fa
  0x502000001400: fa fa 01 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb


Version: 8fefee2d41b4cce49a791895327aaa8cea7c2c5d

 correctmost <correctmost>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by correctmost (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-05-02 bens Open/ClosedOpen Closed
    2024-02-11 bens StatusNone Fixed
    2024-02-11 bens Assigned toNone bens
        Summaryheap-buffer-overflow in copy_of heap-buffer-overflow in copy_of() when undoing a full justification

    Back to the top

    Copyright © 2025 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-8e77.
    Corresponding source code