bugGNU nano - Bugs: bug #65636, crash when hard-wrapping line with...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65636: crash when hard-wrapping line with selection active and --zap enabled

Submitter:  correctmost <correctmost>
Submitted:  Wed 24 Apr 2024 07:10:49 AM UTC
   
 
Severity:  5 - Blocker Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Thu 02 May 2024 05:42:24 AM UTC, comment #3: 

The fix was released in nano-8.0.  Thanks again for reporting.

Benno Schulenberg <bens>
Group administrator
Thu 25 Apr 2024 09:05:38 AM UTC, comment #2: 

Fixed in git, commit cb029377, by calling expunge() instead of do_delete() when snipping characters in do_wrap().

Thanks for finding this and reporting!

Benno Schulenberg <bens>
Group administrator
Wed 24 Apr 2024 03:46:11 PM UTC, comment #1: 

Wow...  Bug exists since version 3.2, when --zap was introduced.  The offending commit is ae3ec178: "add --zap, that makes <Bsp> and <Del> erase a marked region".

What seemed strange is that --zap affects plain typing-with-the-mark-on.  But looking at the diff and at do_wrap()... the latter calls do_delete() in several places, and do_delete() has been modified to do something different when the mark is on...  Ouch.

Will have to think about how to fix that.

Benno Schulenberg <bens>
Group administrator
Wed 24 Apr 2024 07:10:49 AM UTC, original submission:  

File set-up for 'zap.txt':

for col in $(seq 20); do
  echo -n "aaa ";
done > zap.txt


Steps to reproduce:
1 - Run `src/nano --ignore --zap --breaklonglines zap.txt` in an 80x24 terminal
2 - Alt + a
3 - Type b
4 - Type b
--> The top line disappears
5 - Type b
--> nano crashes

ASan output:

ERROR: AddressSanitizer: negative-size-param: (size=-1)
    #0 0x57ac8fcb14c9 in __asan_memmove (/home/s/code/nano/src/nano+0x20c4c9)
    #1 0x57ac8fd54cbb in inject /home/s/code/nano/src/nano.c:1490:2
    #2 0x57ac8fd56905 in process_a_keystroke /home/s/code/nano/src/nano.c:1628:3
    #3 0x57ac8fd5d4f3 in main /home/s/code/nano/src/nano.c:2660:3
    #4 0x7455f5b78ccf  (/usr/lib/libc.so.6+0x25ccf)
    #5 0x7455f5b78d89 in __libc_start_main (/usr/lib/libc.so.6+0x25d89)
    #6 0x57ac8fbc53e4 in _start (/home/s/code/nano/src/nano+0x1203e4)

0x5020000012f2 is located 0 bytes after 2-byte region [0x5020000012f0,0x5020000012f2)
allocated by thread T0 here:
    #0 0x57ac8fcb36da in realloc.part.0 (/home/s/code/nano/src/nano+0x20e6da)
    #1 0x57ac8fdb2e32 in nrealloc /home/s/code/nano/src/utils.c:304:12
    #2 0x57ac8fd54aeb in inject /home/s/code/nano/src/nano.c:1489:19
    #3 0x57ac8fd56905 in process_a_keystroke /home/s/code/nano/src/nano.c:1628:3
    #4 0x57ac8fd5d4f3 in main /home/s/code/nano/src/nano.c:2660:3
    #5 0x7455f5b78ccf  (/usr/lib/libc.so.6+0x25ccf)

SUMMARY: AddressSanitizer: negative-size-param (/home/s/code/nano/src/nano+0x20c4c9) in __asan_memmove


Version: d53521a631166ba67cc2c4e039a2ffaefc10ae2d

correctmost <correctmost>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by correctmost (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-05-02 bens Open/ClosedOpen Closed
    2024-04-25 bens StatusNone Fixed
    2024-04-24 bens Severity3 - Normal 5 - Blocker
        Assigned toNone bens

    Back to the top

    Powered by Savane 3.13-bb6a.
    Corresponding source code