patchGNU nano - Patches: patch #9621, fix a segfault in the search for...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #9621: fix a segfault in the search for word completions

Submitter:  easyaspi314 <easyaspi314>
Submitted:  Mon 23 Apr 2018 12:39:06 AM UTC
   
 
Priority:  7 - High Status:  Done
Privacy:  Public Assigned to:  bens
Open/Closed:  Closed Release:  None

Jump to the original submission

Mon 23 Apr 2018 03:25:20 PM UTC, comment #6: 

Bug has been rereported as bug #53722.  Thanks.

About the other warnings...  If you have patches for some of them, please open a new issue.

Benno Schulenberg <bens>
Group administrator
Mon 23 Apr 2018 02:51:42 PM UTC, comment #5: 

Well, I am a little confused about why this is the case:

int threshold = strlen(pletion_line->data) - shard_length - 1;

strlen and shard_length are both size_t.

The signed-to-unsigned conversions, 64-bit to 32-bit conversions, and the signed-to-unsigned comparisons seem very common, check out the output from

clang -DHAVE_CONFIG_H -Weverything -Wno-padded  -Wno-reserved-id-macro -Wno-disabled-macro-expansion -Wno-missing-prototypes -Wno-cast-qual -I. -I.. -DLOCALEDIR=\"/usr/local/share/locale\" -DSYSCONFDIR=\"/usr/local/etc\" -I../lib *.c ../lib/libgnu.a -o nano -O2 -lncursesw -lz -L/usr/local/opt/ncurses/lib -I/usr/local/opt/ncurses/include  &> errors.txt

in the file attached.

We should really work on fixing these.

(file #43993)

easyaspi314 <easyaspi314>
Mon 23 Apr 2018 12:23:45 PM UTC, comment #4: 

The segfault is prevented by forcing a signed comparison.  See attached patch.

(file #43991)

Benno Schulenberg <bens>
Group administrator
Mon 23 Apr 2018 12:14:53 PM UTC, comment #3: 

Oh wow.  When I type s, and then ^] ^] ^] ^] ^], I get:
share
shift
sourceware
show bug
Segmentation fault

:)

Please report this as a bug, under "Bugs".

Benno Schulenberg <bens>
Group administrator
Mon 23 Apr 2018 12:05:49 PM UTC, comment #2: 

Simple.

Open an empty muffer, type a letter, spam ^].

easyaspi314 <easyaspi314>
Mon 23 Apr 2018 08:22:59 AM UTC, comment #1: 

Do you have a reproduction recipe for the crash?

The problem seems to be that 'i' is size_t and 'threshold' is int -- the comparison 'i < threshold' should be FALSE when threshold is negative.  But maybe the comparison gets cast automatically to size_t, making threshold a large number?

Benno Schulenberg <bens>
Group administrator
Mon 23 Apr 2018 12:39:06 AM UTC, original submission:  

I don't know why the for loop continues to execute, but if threshold is negative, which it appears to be at the end of the list, we get a segfault after reading a bunch of stuff out of bounds.

This at least temporarily works around it until we find the real cause.

I would check the i++ and the ++i usages in the for loop.

easyaspi314 <easyaspi314>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #43993:  errors.txt added by easyaspi314 (100KiB - text/plain)
file #43991:  avoid-completion-crash.patch added by bens (471B - text/x-patch)
file #43988:  crash.patch added by easyaspi314 (498B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by easyaspi314 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-04-29 bens Open/ClosedOpen Closed
    2018-04-23 bens StatusIn Progress Done
    2018-04-23 easyaspi314 Attached File- Added errors.txt, #43993
    2018-04-23 bens Attached File- Added avoid-completion-crash.patch, #43991
    2018-04-23 bens StatusNone In Progress
        Assigned toNone bens
    2018-04-23 bens SummaryFix segfault in spamming word completions fix a segfault in the search for word completions
    2018-04-23 easyaspi314 Attached File- Added crash.patch, #43988

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code