https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279545
Bug ID: 279545
Summary: libedit vi_change_case() can read before the start of
a buffer
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: bin
Assignee: [email protected]
Reporter: [email protected]
If the buffer has just one character in it, then vi_change_case()
will set cursor to the start of the buffer and then call re_fastaddc():
vi_change_case(EditLine *el, wint_t c)
{
...;
if (++el->el_line.cursor >= el->el_line.lastchar) {
el->el_line.cursor--;
re_fastaddc(el);
And then re_fastaddc()'s "-1" is an invalid reference:
re_fastaddc(EditLine *el)
{
...;
c = el->el_line.cursor[-1];
One can reproduce this using valgrind on /bin/sh:
$ set -o vi
$ x ESC ~
(that is, type x, then escape, then ~)
Invalid read of size 4
at 0x4891EF2: re_fastaddc (rtm/freebsd/contrib/libedit/refresh.c:1158)
by 0x489C95F: vi_change_case (rtm/freebsd/contrib/libedit/vi.c:272)
by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
by 0x1295D2: main (rtm/freebsd/bin/sh/main.c:167)
Address 0x552188c is 4 bytes before a block of size 4,096 alloc'd
at 0x4851735: calloc (vg_replace_malloc.c:1599)
by 0x48740AA: ch_init (rtm/freebsd/contrib/libedit/chared.c:399)
by 0x4877714: el_init_internal (rtm/freebsd/contrib/libedit/el.c:107)
by 0x48775B0: el_init_fd (rtm/freebsd/contrib/libedit/el.c:124)
by 0x487754A: el_init (rtm/freebsd/contrib/libedit/el.c:66)
by 0x1215BC: histedit (rtm/freebsd/bin/sh/histedit.c:183)
by 0x12C1ED: optschanged (rtm/freebsd/bin/sh/options.c:130)
by 0x12BEA1: procargs (rtm/freebsd/bin/sh/options.c:121)
by 0x1293EC: main (rtm/freebsd/bin/sh/main.c:131)
FreeBSD stock14 15.0-CURRENT FreeBSD 15.0-CURRENT #22
main-n270479-ecd1d1f1dac4-dirty: Thu May 30 18:42:11 AST 2024
root@stock14:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
--
You are receiving this mail because:
You are the assignee for the bug.
