GNU nano - Bugs: bug #46348, heap overflow of one byte in...
You are not allowed to post comments on this tracker with your current authentication level.
bug #46348: heap overflow of one byte in function parse_mbchar() with multibyte unicode characters
Submitter: | Hanno Boeck <hanno> | ||
Submitted: | Sat 31 Oct 2015 02:58:24 PM UTC | ||
Severity: | 3 - Normal | Status: | Duplicate |
Assigned to: | bens | Open/Closed: | Closed |
Sat 31 Oct 2015 05:26:28 PM UTC, comment #3: |
Hanno Boeck <hanno> |
Sat 31 Oct 2015 05:11:04 PM UTC, comment #2: Thanks for reporting! (I'll close the bug when a version containing the fix has been released. I'm waiting for Chris to release 2.4.3 or 2.5.0.)
|
Benno Schulenberg <bens> |
Sat 31 Oct 2015 03:21:08 PM UTC, comment #1: Apologies, I haven't checked the svn code. It seems this is already fixed with commit revision 5347 and this is actually a duplicate of bug #45718.
|
Hanno Boeck <hanno> |
Sat 31 Oct 2015 02:58:24 PM UTC, original submission:
I noticed a write heap overflow in nano when typing in a $ and any 3-byte or 4-byte unicode char. On a US intl keyboard layout this can e.g. be achieved with altgr-0. But it can also just be tested with the attached file.
|
Hanno Boeck <hanno> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2015-12-07 | bens | Open/Closed | Open | Closed | |
2015-10-31 | bens | Status | None | Duplicate | |
Assigned to | None | bens | |||
Summary | Heap overflow of one byte in function parse_mbchar with multibyte unicode characters | heap overflow of one byte in function parse_mbchar() with multibyte unicode characters | |||
2015-10-31 | hanno | Attached File | - | Added nano-heapoverflow-write-parse_mbchar, #35348 |
Powered by Savane 3.13-4448.
Corresponding source code
I found this through normal use (currently trying to generate a Gentoo system built with address sanitizer).
But fuzzing also works, just replicated that, afl found the same issue within seconds. Seems if nano doesn't have a console it will parse the file and then quit because it can't open. That's exactly what you want for fuzzing, so it's straightforward.
I also tried fuzzing the latest nano svn (which has the fix). Nothing found yet, but if that changes I'll report it :-)