From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#61896: 30.0.50; Emacs crashes because of an invalid free Date: Thu, 02 Mar 2023 11:41:05 +0200 Message-ID: <83mt4vebin.fsf@gnu.org> References: <87fsaoqkwo.fsf@posteo.net> <83zg8vel1t.fsf@gnu.org> <875ybjcz4t.fsf@posteo.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="6675"; mail-complaints-to="usenet@ciao.gmane.io" Cc: mattiase@acm.org, 61896@debbugs.gnu.org To: Philip Kaludercic Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Thu Mar 02 10:41:24 2023 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pXfRE-0001ZY-3Y for geb-bug-gnu-emacs@m.gmane-mx.org; Thu, 02 Mar 2023 10:41:24 +0100 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pXfQu-0006zg-Nv; Thu, 02 Mar 2023 04:41:04 -0500 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pXfQs-0006y4-Is for bug-gnu-emacs@gnu.org; Thu, 02 Mar 2023 04:41:02 -0500 Original-Received: from debbugs.gnu.org ([209.51.188.43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1pXfQs-0002Um-Au for bug-gnu-emacs@gnu.org; Thu, 02 Mar 2023 04:41:02 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1pXfQr-0007yH-S1 for bug-gnu-emacs@gnu.org; Thu, 02 Mar 2023 04:41:01 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Eli Zaretskii Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Thu, 02 Mar 2023 09:41:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 61896 X-GNU-PR-Package: emacs Original-Received: via spool by 61896-submit@debbugs.gnu.org id=B61896.167775005730612 (code B ref 61896); Thu, 02 Mar 2023 09:41:01 +0000 Original-Received: (at 61896) by debbugs.gnu.org; 2 Mar 2023 09:40:57 +0000 Original-Received: from localhost ([127.0.0.1]:55803 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1pXfQn-0007xg-4d for submit@debbugs.gnu.org; Thu, 02 Mar 2023 04:40:57 -0500 Original-Received: from eggs.gnu.org ([209.51.188.92]:43344) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1pXfQm-0007xR-1r for 61896@debbugs.gnu.org; Thu, 02 Mar 2023 04:40:56 -0500 Original-Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pXfQf-0002S3-Jm; Thu, 02 Mar 2023 04:40:50 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-version:References:Subject:In-Reply-To:To:From: Date; bh=jiwXyH+ADec8bL1K4uaScJyzjOwAR0hyeuK2VAcyiIo=; b=Mcx5aCGSXtQuYoEFmbMF O0iWtWc6TMM4chsEGLf/pg3hbNlXfH2w03OPzH4axBTZlWvwTDGo/57aZMPksEx/wazVU4uG7EOrE /iqn3jEWxwOxO2uaZrPqJzJisNLjekFp7+TmuNsmdbMjLt0f3ycx1OF8IxSYdRINLWMprrFY4/3ZP elnHvHiTbc/joa9E4Z3mzUOR7BLeByUvJkoRiEHHZswHMpwfhb9/CZBB7+4i+KuvgSxl+Xl4XZ19x XTk/Jugm4/P7WnewWwaUYoRVU5HcJ6+SJzKsiW11HvdPji7FTFaAq3zzZdqPTFv8iqU68yIdOWZO7 0zVkxfH0zlNktA==; Original-Received: from [87.69.77.57] (helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pXfQf-0006WG-3G; Thu, 02 Mar 2023 04:40:49 -0500 In-Reply-To: <875ybjcz4t.fsf@posteo.net> (message from Philip Kaludercic on Thu, 02 Mar 2023 08:53:54 +0000) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.bugs:257123 Archived-At: > From: Philip Kaludercic > Cc: Mattias Engdegård , > 61896@debbugs.gnu.org > Date: Thu, 02 Mar 2023 08:53:54 +0000 > > >From what I recall, the address being freed was on the stack. How does > the byte-code interpreter behave when the input is broken? Is there > some way of validating if the byte-code is "coherent"? If I manually > modify the byte code and replace random bytes, is the interpreter > written to expect this kind of issue? Sorry, I don't understand the questions. Maybe Mattias will. My interpretation of this problem is that some corruption happened to the specpdl stuff, which causes SAFE_FREE decide that some data should be 'free'd when it was actually allocated off the stack. The question is how could that happen.