Dominique wrote:
> Valgrind or asan detect invalid memory access in Vim-7.4.811
> when doing:
>
> $ vim -u NONE -c 'call g:'
>
> Attached patch fixes it.
>
> Bug was found using afl-fuzz + asan.
> Here's valgrind report:
>
> ==4107== Memcheck, a memory error detector
> ==4107== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
> ==4107== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
> info
> ==4107== Command: /home/pel/sb/vim/src/vim -u NONE -c call\ g:
> ==4107== Parent PID: 2659
> ==4107==
> ==4107== Invalid read of size 1
> ==4107== at 0x430128: find_var_ht (eval.c:21319)
> ==4107== by 0x43255A: find_var (eval.c:21245)
> ==4107== by 0x42FA1E: deref_func_name (eval.c:8511)
> ==4107== by 0x42F30C: ex_call (eval.c:3479)
> ==4107== by 0x45B2C5: do_one_cmd (ex_docmd.c:2941)
> ==4107== by 0x4586B0: do_cmdline (ex_docmd.c:1133)
> ==4107== by 0x580C89: exe_commands (main.c:2926)
> ==4107== by 0x57EB47: main (main.c:961)
> ==4107== Address 0xcd43261 is 0 bytes after a block of size 1 alloc'd
> ==4107== at 0x4C2AB80: malloc (in
> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
> ==4107== by 0x4B4227: lalloc (misc2.c:921)
> ==4107== by 0x42F966: trans_function_name (eval.c:23062)
> ==4107== by 0x42F2A8: ex_call (eval.c:3462)
> ==4107== by 0x45B2C5: do_one_cmd (ex_docmd.c:2941)
> ==4107== by 0x4586B0: do_cmdline (ex_docmd.c:1133)
> ==4107== by 0x580C89: exe_commands (main.c:2926)
> ==4107== by 0x57EB47: main (main.c:961)
Thanks for fixing another problem!
--
MORTICIAN: Bring out your dead!
[clang]
Bring out your dead!
[clang]
Bring out your dead!
CUSTOMER: Here's one -- nine pence.
DEAD PERSON: I'm not dead!
The Quest for the Holy Grail (Monty Python)
/// Bram Moolenaar -- [email protected] -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ an exciting new programming language -- http://www.Zimbu.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
