bugGNU nano - Bugs: bug #65586, invalid read when cutting an...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65586: invalid read when cutting an autoindented region

Submitter:  correctmost <correctmost>
Submitted:  Fri 12 Apr 2024 11:27:19 PM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Open

Sat 13 Apr 2024 02:38:43 PM UTC, comment #2: 

Fixed in git, commit c695d49a, by pulling the adjustment of the mark forward, to before changing 'current_x' when the newly created line would be entirely blank.

Bug existed since version 2.8.1, commit 005ee8ed: "avoid creating blank lines when using autoindent".

Thanks for searching, and finding, and reporting!

Benno Schulenberg <bens>
Group administrator
Sat 13 Apr 2024 02:24:47 PM UTC, comment #1: 

A recipe that shows visible wrong behavior:

src/nano --ignore --auto --line

Then type: abc <Left> <Left> M-A <Left> <Space> <Enter> ^K

Notice that the <Enter> caused the "b" to be highlighted, and that the ^K cut both the "a" and the "b", instead of only the "a" -- verify by typing ^U a few times.

Benno Schulenberg <bens>
Group administrator
Fri 12 Apr 2024 11:27:19 PM UTC, original submission:  

Steps to reproduce:
1 - Run `valgrind src/nano --ignore --autoindent`
2 - Type a
3 - Alt + a
4 - Press the left arrow
5 - Press space
6 - Press enter
7 - Ctrl + k

Valgrind output:

Invalid read of size 1
   at 0x484C2C6: __strlen_sse2 (vg_replace_strmem.c:504)
   by 0x1128F5: extract_segment (cut.c:273)
   by 0x1131AE: cut_marked_region (cut.c:469)
   by 0x1132D0: do_snip (cut.c:499)
   by 0x1134EE: cut_text (cut.c:548)
   by 0x126491: process_a_keystroke (nano.c:1688)
   by 0x128346: main (nano.c:2660)
 Address 0x4d04f73 is 0 bytes after a block of size 3 alloc'd
   at 0x4843788: malloc (vg_replace_malloc.c:442)
   by 0x139913: nmalloc (utils.c:293)
   by 0x13351E: do_enter (text.c:876)
   by 0x126491: process_a_keystroke (nano.c:1688)
   by 0x128346: main (nano.c:2660)

Invalid read of size 1
   at 0x484D780: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1144)
   by 0x112920: extract_segment (cut.c:273)
   by 0x1131AE: cut_marked_region (cut.c:469)
   by 0x1132D0: do_snip (cut.c:499)
   by 0x1134EE: cut_text (cut.c:548)
   by 0x126491: process_a_keystroke (nano.c:1688)
   by 0x128346: main (nano.c:2660)
 Address 0x4d04f73 is 0 bytes after a block of size 3 alloc'd
   at 0x4843788: malloc (vg_replace_malloc.c:442)
   by 0x139913: nmalloc (utils.c:293)
   by 0x13351E: do_enter (text.c:876)
   by 0x126491: process_a_keystroke (nano.c:1688)
   by 0x128346: main (nano.c:2660)


Version: 3cd3ba0397bec9ce1ccc52e42b32557645bccdc7

correctmost <correctmost>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Updated the item)
  • -email is unavailable- added by correctmost (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-04-13 bens StatusIn Progress Fixed
        Summaryinvalid read when cutting autoindented region invalid read when cutting an autoindented region
    2024-04-13 bens StatusNone In Progress
        Assigned toNone bens

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code