Re: [Nano-devel] [bug] segfault when pasting then cutting, when mark is on

[Asheesh Laroia]

On Mon, 23 Jul 2012, Tyrell Keene wrote:

> On Mon, Jul 23, 2012 at 10:00 PM, Asheesh Laroia <address@hidden> wrote:
>
> > Excerpts from Benno Schulenberg's message of Sun Jul 22 12:42:08 -0400
> > 2012:
> > > Hi,
> > >
> > > The editor segfaults when some text is marked, something is
> > > pasted, then something cut, and then a Cursor-up is done.
> > >
> > > How to reproduce:
> > >
> > > Start nano with an empty buffer, then type
> > > for example the following two lines:
> > >
> > > first line
> > > second line
> > >
> > > Place the cursor in the first line and type ^K
> > > to have a non-empty cut buffer.
> > >
> > > Then type:  Alt-A  Cursor-right  ^U  ^K  Cursor-up
> > >
> > > (The Cursor-right may be done several times, as long
> > > as it stays on the same line.)
> > >
> > > Result: Segmentation fault
> > >
> > > Found on nano 2.2.5, bug still present in SVN (nano 2.3.1).
> >
> > I can reproduce this on GNU nano 2.2.6 in Debian unstable/sid/wheezy
> > at the moment. I'll work on reproducing the issue.
> >
> > Benno, thank you for reporting this with such a clear description
> > of the problem!
> >
> > I'm curious if you happen to be a C programmer, and/or if you are
> > familiar with applying patches. It'd be great if you could read through
> > and test a patch if I manage to come up with one.
> >
> > -- Asheesh.
> >
> > _______________________________________________
> > Nano-devel mailing list
> > address@hidden
> > https://lists.gnu.org/mailman/listinfo/nano-devel
>
> I have also been able to reproduce this behaviour on nano 2.3.1 compiled
> with gcc (Gentoo 4.5.3-r2 p1.5, pie-0.4.7) 4.5.3
> And nano 2.2.5 compiled with the above mentioned version of gcc.
>
> I would be more than willing to test any patches and assist in the fixing
> of this little bug.

Great!

Some further info:

(gdb) l
503
504	    assert(ISSET(SOFTWRAP) || openfile->current_y == 
openfile->current->lineno - openfile->edittop->lineno);
505
506         /* Move the current line of the edit window up. */
507         openfile->current = openfile->current->prev;
508         openfile->current_x = actual_x(openfile->current->data,
509             openfile->placewewant);
510
511	    /* If scroll_only is FALSE and if we're on the first line 
of the
512	     * edit window, scroll the edit window up one line if 
we're in

(gdb) 
bt
#0  0x0000000000411e05 in do_up (scroll_only=false) at move.c:508
#1  0x0000000000411f16 in do_up_void () at move.c:541
#2  0x0000000000414ade in do_input (meta_key=0x7fffffffe1ff, 
func_key=0x7fffffffe1fe, s_or_t=0x7fffffffe1fd, ran_func=0x7fffffffe1fc, 
finished=0x7fffffffe1fb, allow_funcs=true) at nano.c:1658
#3  0x000000000041650f in main (argc=1, argv=0x7fffffffe8c8) at 
nano.c:2728
(gdb) x/10i 0x411df0
   0x411df0 <do_up+116>:	mov    0x223b02(%rip),%eax        # 
0x6358f8 <openfile>
   0x411df6 <do_up+122>:  mov    0x38(%rax),%rdx
   0x411dfa <do_up+126>:	mov    0x223af7(%rip),%rax        # 
0x6358f8 <openfile>
   0x411e01 <do_up+133>:  mov    0x20(%rax),%rax
=> 0x411e05 <do_up+137>:       mov    (%rax),%rax
   0x411e08 <do_up+140>:  mov    %rdx,%rsi
   0x411e0b <do_up+143>:  mov    %rax,%rdi
   0x411e0e <do_up+146>:  callq  0x423e52 <actual_x>
   0x411e13 <do_up+151>:  mov    %rax,0x30(%rbx)
   0x411e17 <do_up+155>:	mov    0x223ada(%rip),%rax        # 
0x6358f8 <openfile>
(gdb) print (openfile)->current
$6 = (filestruct *) 0x0


The issue here is that, for some reason, openfile->current is a NULL 
pointer, and this gets dereferenced in the run-up to calling actual_x().

nano.h has this documentation for us:

    filestruct *current;
        /* The current file's current line. */

So... why is openfile->current a NULL poiner, when it should be an actual 
filestruct.

NOTE that I had to recompile with:

    CFLAGS="-O0 -ggdb3" ./configure

in order to get a reasonable stack trace. (In particular, if I didn't, 
then gdb would report that openfile->current had a value other than zero.)

Further work awaits us in finding out *why* -- I'm pretty new to the nano 
code.

-- Asheesh.