bugGNU nano - Bugs: bug #65317, with --cutfromcursor, undoing a...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65317: with --cutfromcursor, undoing a justification can eat a line

Submitter:  correctmost <correctmost>
Submitted:  Thu 15 Feb 2024 06:38:02 AM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Open

Fri 16 Feb 2024 03:11:30 PM UTC, comment #2: 

Fixed in git, commit 190221c9, by setting 'current_x' always to zero when a paragraph is found.

This "random typing" of your scripts is pretty good at finding bugs.  Thanks for reporting!

Benno Schulenberg <bens>
Group administrator
Thu 15 Feb 2024 03:36:57 PM UTC, comment #1: 

Oww...  Concentrating again on visible misbehavior, run:

src/nano --ignore --cutfrom  +9,22  README

Note that the first paragraph begins with "Nano is a small and simple".
Now type: ^J M-U  (that is: justify the paragraph and undo it).
See that the first line of the parapgrah is gone.  Ouch!

The first line of the restored paragraph is eaten whenever the cursor is not at the start of the line.

It's not extract_segment() that needs 'openfile->current_x' to be zero; it's add_undo().

Benno Schulenberg <bens>
Group administrator
Thu 15 Feb 2024 06:38:02 AM UTC, original submission:  

These steps are almost the same as the steps from bug #65289 except a paragraph is justified instead of the entire buffer.

Steps to reproduce:
1 - Run `nano --ignore`
2 - Alt + k
3 - Type a
4 - Ctrl + j
5 - Alt + u
--> You may have to run with Valgrind or AddressSanitizer to see the memory error

Backtrace:

==1469540==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000001351 at pc 0x62835632be15 bp 0x7ffd25df4dd0 sp 0x7ffd25df4590
READ of size 1 at 0x502000001351 thread T0
    #0 0x62835632be14 in __interceptor_strlen.part.0 (/usr/local/bin/nano+0xdfe14)
    #1 0x62835648f632 in copy_of /home/s/code/nano/src/utils.c:339:31
    #2 0x6283564200ee in ingraft_buffer /home/s/code/nano/src/cut.c:375:19
    #3 0x62835642082c in copy_from_buffer /home/s/code/nano/src/cut.c:450:2
    #4 0x62835647dad4 in undo_cut /home/s/code/nano/src/text.c:464:3
    #5 0x62835647e2e9 in do_undo /home/s/code/nano/src/text.c
    #6 0x62835647e0af in do_undo /home/s/code/nano/src/text.c:629:3
    #7 0x62835645fa0d in process_a_keystroke /home/s/code/nano/src/nano.c:1685:2
    #8 0x628356463fd3 in main /home/s/code/nano/src/nano.c:2651:3
    #9 0x792a5f68accf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #10 0x792a5f68ad89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #11 0x6283562dd0f4 in _start (/usr/local/bin/nano+0x910f4)

0x502000001351 is located 0 bytes after 1-byte region [0x502000001350,0x502000001351)
allocated by thread T0 here:
    #0 0x6283563caa2a in __interceptor_realloc.part.0 (/usr/local/bin/nano+0x17ea2a)
    #1 0x6283564906da in nrealloc /home/s/code/nano/src/utils.c:304:12
    #2 0x628356420401 in ingraft_buffer /home/s/code/nano/src/cut.c:414:19
    #3 0x6283564885f4 in justify_text /home/s/code/nano/src/text.c:1969:2
    #4 0x62835645fa0d in process_a_keystroke /home/s/code/nano/src/nano.c:1685:2
    #5 0x628356463fd3 in main /home/s/code/nano/src/nano.c:2651:3
    #6 0x792a5f68accf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #7 0x792a5f68ad89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #8 0x6283562dd0f4 in _start (/usr/local/bin/nano+0x910f4)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/local/bin/nano+0xdfe14) in __interceptor_strlen.part.0
Shadow bytes around the buggy address:
  0x502000001080: fa fa 05 fa fa fa 01 fa fa fa 00 00 fa fa fd fa
  0x502000001100: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 01 fa
  0x502000001180: fa fa fd fa fa fa 00 04 fa fa fd fa fa fa fd fa
  0x502000001200: fa fa 02 fa fa fa 00 06 fa fa fd fa fa fa 02 fa
  0x502000001280: fa fa 01 fa fa fa fd fa fa fa 02 fa fa fa 01 fa
=>0x502000001300: fa fa fd fa fa fa fd fa fa fa[01]fa fa fa 00 06
  0x502000001380: fa fa fd fa fa fa 02 fa fa fa 01 fa fa fa fa fa
  0x502000001400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1469540==ABORTING
Sorry! Nano crashed!  Code: 6.  Please report a bug.


Version: 77d74b5d811f6507a69e90cff77a903073c733da

correctmost <correctmost>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by correctmost (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-02-16 bens StatusNone Fixed
    2024-02-15 bens Severity3 - Normal 4 - Important
        Assigned toNone bens
        Summaryheap-buffer-overflow in copy_of() when undoing a paragraph justification with --cutfromcursor, undoing a justification can eat a line

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code