bugGNU nano - Bugs: bug #67578, heap-buffer-overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #67578: heap-buffer-overflow in is_blank_char() with autoindent

Submitter:  correctmost <correctmost>
Submitted:  Sun 05 Oct 2025 02:35:28 AM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Discussion

Thu 13 Nov 2025 08:24:18 AM UTC, comment #3: 

The fix was released in nano-8.7.  Thanks again for reporting.

Benno Schulenberg <bens>
Group administrator
Sun 05 Oct 2025 10:01:07 AM UTC, comment #2: 

Fixed in git, commit f08c0300, by setting also 'mark_x' to zero when 'allblanks' became true and the mark is still on the current line.

Thanks for reporting.  :)

Benno Schulenberg <bens>
Group administrator
Sun 05 Oct 2025 09:04:24 AM UTC, comment #1: 

To make the issue easier to reproduce, I first defined a custom nanorc:

echo 'bind M-H "{tab}{mark}{enter}AAAA{up}{enter}{justify}" main' >makefail.rc

Then I ran `src/nano --auto --rc=makefail.rc` and typed M-H ^X ^Q while running the invocation of nano in valgrind.  And sure enough: "Invalid read of size 1...".

Looking at the code in do_enter(), I quickly realized that when 'allblanks' becomes true, 'mark_x' does not get set to zero together with 'current_x', leaving 'mark_x' pointing somewhere in a line that is actually empty.  Oops.

Benno Schulenberg <bens>
Group administrator
Sun 05 Oct 2025 02:35:28 AM UTC, original submission:  

Steps to reproduce:
1 - Run `src/nano --ignore --autoindent`
2 - Press Tab
3 - Alt + a
4 - Press enter
5 - Type a
6 - Press up
7 - Press enter
8 - Ctrl + j
--> out-of-bounds read

ASan output:

ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bf65d3e15d1
READ of size 1 at 0x7bf65d3e15d1 thread T0
    #0 0x55bb93fd99d8 in is_blank_char nano/src/chars.c:69:19
    #1 0x55bb940778d3 in justify_text nano/src/text.c:1815:23
    #2 0x55bb9407ad12 in do_justify nano/src/text.c:2026:2
    #3 0x55bb9402e16e in process_a_keystroke nano/src/nano.c:1711:2
    #4 0x55bb94034cd3 in main nano/src/nano.c:2730:3

0x7bf65d3e15d1 is located 0 bytes after 1-byte region [0x7bf65d3e15d0,0x7bf65d3e15d1)
allocated by thread T0 here:
    #0 0x7fd65e972fc5 in malloc
    #1 0x55bb94086e72 in nmalloc nano/src/utils.c:294:18
    #2 0x55bb9406b0cb in do_enter nano/src/text.c:879:18
    #3 0x55bb9402e16e in process_a_keystroke nano/src/nano.c:1711:2
    #4 0x55bb94034cd3 in main nano/src/nano.c:2730:3


Version: 43f0618f77a45fc40cf67bef665682588eef33ac

correctmost <correctmost>

 

Attached Files

This item currently has no attached files.

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by correctmost (Submitted the item)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    History

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-11-13 bens Open/ClosedOpen Closed
    2025-10-05 bens StatusIn progress Fixed
    2025-10-05 bens StatusNone In progress
        Assigned toNone bens
        Summaryheap-buffer-overflow in is_blank_char with autoindent heap-buffer-overflow in is_blank_char() with autoindent

    Back to the top

    Powered by Savane 3.16-ed84.
    Corresponding source code