--- Begin Message ---
Subject: |
Emacs crashes while parsing a long Emacs Lisp string |
Date: |
Tue, 07 Mar 2023 22:51:58 +0100 |
When parsing a particular long Emacs Lisp string, Emacs crashes.
How to reproduce:
$ emacs -Q -batch -f batch-byte-compile foo.el
Segmentation fault
Find attached the compressed file foo.el.
Emacs version: 27.1
Platform: x86_64-linux-gnu
$ ulimit -a | grep stack
stack size (kbytes, -s) 8192
According to the documentation
https://www.gnu.org/software/emacs/manual/html_node/emacs/Bug-Criteria.html
any segmentation fault is a bug.
I haven't analyzed the security impact of this bug, but it is quite possible
that emacs receives a string through the network, and even though the string
is not meant to be evaluated, simply parsing it causes a denial-of-service
to the emacs user.
The cause of the bug is that in emacs/src/lread.c the function read_escape()
is recursive, and no bound on the recursion depth is enforced.
foo.el.gz
Description: application/gzip
--- End Message ---