GNU nano - Bugs: bug #60764, heap buffer overflow when toggling...
You are not allowed to post comments on this tracker with your current authentication level.
bug #60764: heap buffer overflow when toggling "pipe" twice
Submitter: | Benno Schulenberg <bens> | ||
Submitted: | Thu 10 Jun 2021 09:15:04 AM UTC | ||
Severity: | 3 - Normal | Status: | Fixed |
Assigned to: | bens | Open/Closed: | Closed |
Thu 10 Jun 2021 09:42:20 AM UTC, comment #3: |
Benno Schulenberg <bens> |
Thu 10 Jun 2021 09:33:18 AM UTC, comment #2: The problem is that when wanting to remove the "|", we want to reduce the size of the answer by one byte, so we should not move strlen(answer) + 1 bytes (the full answer plus the nul byte), but just strlen(answer) (the answer minus the leading "|" plus the terminating nul byte).
|
Benno Schulenberg <bens> |
Thu 10 Jun 2021 09:20:07 AM UTC, comment #1: A similar recipe (^T M-\ M-\ ^C ^X) in valgrind gives this:
|
Benno Schulenberg <bens> |
Thu 10 Jun 2021 09:15:04 AM UTC, original submission:
To reproduce, configire nano with CFLAGS="-g -O0 -fsanitize=address", compile, and then run:
Then type: ^T M-\ M-\
|
Benno Schulenberg <bens> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 3 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2021-06-16 | bens | Open/Closed | Open | Closed | |
2021-06-10 | bens | Status | In Progress | Fixed | |
2021-06-10 | bens | Status | None | In Progress |
Powered by Savane 3.13-758e.
Corresponding source code
Fixed in git, commit d7e32261, by moving one byte less.