bugGNU nano - Bugs: bug #60436, use-after-free detected when undo...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60436: use-after-free detected when undo goes offscreen

Submitter:  Benno Schulenberg <bens>
Submitted:  Thu 22 Apr 2021 10:34:08 AM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Tue 05 Jul 2022 11:56:16 AM UTC, comment #3: 

The check is needed also for a fourth case: when doing a Backspace while at the beginning of the first row of the screen (and this first row is not the first line of the file).

Benno Schulenberg <bens>
Group administrator
Fri 23 Apr 2021 08:51:27 AM UTC, comment #2: 

Fixed in git, commit 588022ab, by stepping 'edittop' one line back in delete_node() when needed.

This burdens every node deletion with an additional check, but... it is needed in three places: undoing an ENTER, redoing a JOIN, and removing a magicline.  (The normal cutting of a line or a region checks whether edittop is affected, and adjusts it when needed, so in that case the stepping back is a superfluous action.)

Benno Schulenberg <bens>
Group administrator
Thu 22 Apr 2021 05:57:47 PM UTC, comment #1: 

Bug exists since version 2.3.3 from seven years ago.  :|

The offending commit is 60815461: "Going to the correct positions for undoing and redoing cuts and pastes.  This fixes many undo problems and Savannah bug #25585."  As a side effect this did not always center the cursor for every undo, meaning that the top line of the screen could now get deleted.

Benno Schulenberg <bens>
Group administrator
Thu 22 Apr 2021 10:34:08 AM UTC, original submission:  

To reproduce, configure nano with CFLAGS="-g -O0 -fsanitize=address", compile, and then run:

src/nano --line --ignore 2>TRAIL

Then hold down <Enter> until the first few lines have scrolled offscreen.  Then hold down M-U until the cursor reaches the top row.  Then type one more M-U.  Result: nano is aborted:

==22705==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000005418 at pc 0x56402d8c81c0 bp 0x7ffd67b74cf0 sp 0x7ffd67b74ce0
READ of size 8 at 0x604000005418 thread T0
    #0 0x56402d8c81bf in current_is_above_screen /home/ben/Sources/NANO/src/winio.c:3304
    #1 0x56402d8c872f in current_is_offscreen /home/ben/Sources/NANO/src/winio.c:3333
    #2 0x56402d8c8d7d in edit_refresh /home/ben/Sources/NANO/src/winio.c:3391
    #3 0x56402d884179 in main /home/ben/Sources/NANO/src/nano.c:2517
    #4 0x7ff9ad538bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #5 0x56402d847989 in _start (/home/ben/Sources/NANO/src/nano+0x22989)

0x604000005418 is located 8 bytes inside of 48-byte region [0x604000005410,0x604000005440)
freed by thread T0 here:
    #0 0x7ff9ade3f7a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8)
    #1 0x56402d8cb61d in rpl_free /home/ben/Sources/NANO/lib/free.c:44
    #2 0x56402d8770e4 in delete_node /home/ben/Sources/NANO/src/nano.c:111
    #3 0x56402d8772d9 in unlink_node /home/ben/Sources/NANO/src/nano.c:126
    #4 0x56402d89d417 in do_undo /home/ben/Sources/NANO/src/text.c:541
    #5 0x56402d87e816 in process_a_keystroke /home/ben/Sources/NANO/src/nano.c:1616
    #6 0x56402d884289 in main /home/ben/Sources/NANO/src/nano.c:2531
    #7 0x7ff9ad538bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)


The problem is that the undo at the top of the screen removes the line that 'edittop' refers to.  And to determine whether the cursor has gone offscreen, nano references 'edittop'...  Oops.

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-04-30 bens Open/ClosedOpen Closed
    2021-04-23 bens Severity4 - Important 3 - Normal
        StatusIn Progress Fixed
    2021-04-22 bens StatusNone In Progress

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code