From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Jan Chaloupka Newsgroups: gmane.emacs.bugs Subject: bug#18140: [PATCH] macros.c: CHECK_VECTOR_OR_STRING invokes wrong_type_argument for Qnil instead of return 0 Date: Tue, 29 Jul 2014 07:35:03 +0200 Message-ID: <53D73287.6020406@redhat.com> References: <20140729053056.14713.45327.stgit@unused-4-157.brq.redhat.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1406612187 670 80.91.229.3 (29 Jul 2014 05:36:27 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 29 Jul 2014 05:36:27 +0000 (UTC) To: 18140@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Tue Jul 29 07:36:22 2014 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1XC05D-00050h-8r for geb-bug-gnu-emacs@m.gmane.org; Tue, 29 Jul 2014 07:36:19 +0200 Original-Received: from localhost ([::1]:43752 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XC05C-00088s-ST for geb-bug-gnu-emacs@m.gmane.org; Tue, 29 Jul 2014 01:36:18 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:55026) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XC053-00087v-AB for bug-gnu-emacs@gnu.org; Tue, 29 Jul 2014 01:36:15 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XC04x-0003DZ-3x for bug-gnu-emacs@gnu.org; Tue, 29 Jul 2014 01:36:09 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:46276) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XC04x-0003DT-0Q for bug-gnu-emacs@gnu.org; Tue, 29 Jul 2014 01:36:03 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.80) (envelope-from ) id 1XC04w-0003u7-HL for bug-gnu-emacs@gnu.org; Tue, 29 Jul 2014 01:36:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Jan Chaloupka Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Tue, 29 Jul 2014 05:36:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 18140 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 18140-submit@debbugs.gnu.org id=B18140.140661211214945 (code B ref 18140); Tue, 29 Jul 2014 05:36:02 +0000 Original-Received: (at 18140) by debbugs.gnu.org; 29 Jul 2014 05:35:12 +0000 Original-Received: from localhost ([127.0.0.1]:41542 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1XC047-0003sz-A2 for submit@debbugs.gnu.org; Tue, 29 Jul 2014 01:35:11 -0400 Original-Received: from mx1.redhat.com ([209.132.183.28]:44824) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1XC044-0003sm-1B for 18140@debbugs.gnu.org; Tue, 29 Jul 2014 01:35:09 -0400 Original-Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s6T5Z5jj016481 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for <18140@debbugs.gnu.org>; Tue, 29 Jul 2014 01:35:05 -0400 Original-Received: from unused-4-157.brq.redhat.com (unused-4-228.brq.redhat.com [10.34.4.228]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s6T5Z4wL027521 for <18140@debbugs.gnu.org>; Tue, 29 Jul 2014 01:35:05 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 In-Reply-To: <20140729053056.14713.45327.stgit@unused-4-157.brq.redhat.com> X-Forwarded-Message-Id: <20140729053056.14713.45327.stgit@unused-4-157.brq.redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:91913 Archived-At: Changelog: line wrapping to 80 characters In function Fstart_kbd_macro (macros.c), Vlast_kbd_macro of current_kboard is Qnil for the first invocation. If NILP (append) is false, current_kboard->kbd_macro_ptr has random value (in our case 0x5353535353535353), which after CHECK_VECTOR_OR_STRING failure (invocation of wrong_type_argument) results in garbage collecting. During gc, marking of objects is processed and mark_kboards (keyboard.c) is invoked. Following for loop is fired: for (p = kb->kbd_macro_buffer; p < kb->kbd_macro_ptr; p++) mark_object (*p); Since kb->kbd_macro_ptr is set to 0x5353535353535353, mark_object (*p) is trying to mark object on address out of memory space (or memory that cannot be accessed). Thus resulting in SIGSEGV signal. Solution is to check for Qnil before calling CHECK_VECTOR_OR_STRING and set len to 0 if Qnil occurs. https://bugzilla.redhat.com/show_bug.cgi?id=1104012 Signed-off-by: Jan Chaloupka --- src/macros.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/src/macros.c b/src/macros.c index 4730a8b..4fd6cb1 100644 --- a/src/macros.c +++ b/src/macros.c @@ -85,7 +85,25 @@ macro before appending to it. */) bool cvt; /* Check the type of last-kbd-macro in case Lisp code changed it. */ - len = CHECK_VECTOR_OR_STRING (KVAR (current_kboard, Vlast_kbd_macro)); + /* If Vlast_kbd_macro is Qnil, skip the check and set len to 0. + * Flength returns 0 for Qnil, CHECK_VECTOR_OR_STRING has to do the same. + * Otherwise CHECK_VECTOR_OR_STRING fails and results in garbage + * collecting, which results in (keyboard.c, mark_kboards(void)). + * Among others, mark_kboards it executes: + * + * for (p = kb->kbd_macro_buffer; p < kb->kbd_macro_ptr; p++) + * mark_object (*p); + * + * Here, kb->kbd_macro_ptr is not initialized and can contain address + * 0x5353535353535353, which results in SIGSEGV trying to access + * the address. + * + * https://bugzilla.redhat.com/show_bug.cgi?id=1104012 + */ + if (!NILP (KVAR (current_kboard, Vlast_kbd_macro) )) + len = CHECK_VECTOR_OR_STRING (KVAR (current_kboard, Vlast_kbd_macro)); + else + len = 0; /* Copy last-kbd-macro into the buffer, in case the Lisp code has put another macro there. */