bugGNU nano - Bugs: bug #60447, use-after-free when the user...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60447: use-after-free when the user respects a lock file

Submitter:  Benno Schulenberg <bens>
Submitted:  Fri 23 Apr 2021 10:13:08 AM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Fri 23 Apr 2021 10:28:08 AM UTC, comment #1: 

Fixed in git, commit 6283557d, by setting 'openfile' to NULL earlier and then checking that it isn't NULL before dereferencing it.

And closing because unreleased.

Benno Schulenberg <bens>
Group administrator
Fri 23 Apr 2021 10:13:08 AM UTC, original submission:  

To reproduce, configure nano with CFLAGS="-g -O0 fsanitize=address", compile, then run in one terminal 'src/nano --lock --ignore README', and run in a second terminal:

src/nano --lock --ignore README 2>TRAIL; stty sane; less TRAIL

Answer No to the question "open anyway".  Result: nano is aborted:
+verabtim+
==3580==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100000006f0 at pc 0x5651ff7d7566>
READ of size 8 at 0x6100000006f0 thread T0
    #0 0x5651ff7d7565 in close_buffer /home/ben/Sources/NANO/src/files.c:609
    #1 0x5651ff7d62b9 in open_buffer /home/ben/Sources/NANO/src/files.c:432
    #2 0x5651ff7ff54f in main /home/ben/Sources/NANO/src/nano.c:2419
    #3 0x7f7bb033ebf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #4 0x5651ff7c3989 in _start (/home/ben/Sources/NANO/src/nano+0x22989)

0x6100000006f0 is located 176 bytes inside of 192-byte region [0x610000000640,0x610000000700)
freed by thread T0 here:
    #0 0x7f7bb0c457a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8)
    #1 0x5651ff8476cd in rpl_free /home/ben/Sources/NANO/lib/free.c:44
    #2 0x5651ff7d7516 in close_buffer /home/ben/Sources/NANO/src/files.c:606
    #3 0x5651ff7d62b9 in open_buffer /home/ben/Sources/NANO/src/files.c:432
    #4 0x5651ff7ff54f in main /home/ben/Sources/NANO/src/nano.c:2419
    #5 0x7f7bb033ebf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
-verbatim-

The problem is that when 'orphan' gets freed, there are no open files left, but in the next statement nano refers to 'openfile->next'...  Oops.

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-04-23 bens StatusIn Progress Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-bb6a.
    Corresponding source code