From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Jim Meyering Newsgroups: gmane.emacs.bugs Subject: bug#11288: avoid buffer overrun in display code Date: Fri, 20 Apr 2012 13:42:05 +0200 Message-ID: <87397yljea.fsf@rho.meyering.net> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: dough.gmane.org 1334922172 16542 80.91.229.3 (20 Apr 2012 11:42:52 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Fri, 20 Apr 2012 11:42:52 +0000 (UTC) Cc: Jakub Jelinek , Richard Guenther To: 11288@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Fri Apr 20 13:42:49 2012 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1SLCEi-00061M-99 for geb-bug-gnu-emacs@m.gmane.org; Fri, 20 Apr 2012 13:42:48 +0200 Original-Received: from localhost ([::1]:59613 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLCEh-000841-Fb for geb-bug-gnu-emacs@m.gmane.org; Fri, 20 Apr 2012 07:42:47 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:47258) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLCEb-00083q-1h for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 07:42:45 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SLCEY-0001nf-VU for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 07:42:40 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:42661) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLCEY-0001mn-Rt for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 07:42:38 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.72) (envelope-from ) id 1SLCEw-0007FH-DI for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 07:43:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Jim Meyering Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Fri, 20 Apr 2012 11:43:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 11288 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: X-Debbugs-Original-To: bug-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.133492217427832 (code B ref -1); Fri, 20 Apr 2012 11:43:02 +0000 Original-Received: (at submit) by debbugs.gnu.org; 20 Apr 2012 11:42:54 +0000 Original-Received: from localhost ([127.0.0.1]:43695 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.72) (envelope-from ) id 1SLCEo-0007Er-Es for submit@debbugs.gnu.org; Fri, 20 Apr 2012 07:42:54 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:44356) by debbugs.gnu.org with esmtp (Exim 4.72) (envelope-from ) id 1SLCEl-0007Eb-2b for submit@debbugs.gnu.org; Fri, 20 Apr 2012 07:42:52 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SLCEG-0001j7-1x for submit@debbugs.gnu.org; Fri, 20 Apr 2012 07:42:21 -0400 Original-Received: from lists.gnu.org ([208.118.235.17]:51314) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLCEF-0001iv-Ur for submit@debbugs.gnu.org; Fri, 20 Apr 2012 07:42:19 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:47192) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLCEE-00083X-4w for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 07:42:19 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SLCEC-0001ih-6N for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 07:42:17 -0400 Original-Received: from fencepost.gnu.org ([208.118.235.10]:35882) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLCEC-0001ia-2v for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 07:42:16 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:50300) by fencepost.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1SLCEB-0001EI-9R for bug-emacs@gnu.org; Fri, 20 Apr 2012 07:42:15 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SLCE4-0001hg-FO for bug-emacs@gnu.org; Fri, 20 Apr 2012 07:42:14 -0400 Original-Received: from mx.meyering.net ([88.168.87.75]:50576) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLCE4-0001hV-8u for bug-emacs@gnu.org; Fri, 20 Apr 2012 07:42:08 -0400 Original-Received: from rho.meyering.net (localhost.localdomain [127.0.0.1]) by rho.meyering.net (Acme Bit-Twister) with ESMTP id EB7F0601E0; Fri, 20 Apr 2012 13:42:05 +0200 (CEST) Original-Lines: 27 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.13 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:59314 Archived-At: This bug leads to a seemingly unterminated loop in swap_glyph_pointers, when compiled with gcc-4.8.0 (from April 19 or newer). At first I thought it was a code-gen bug and reported it as http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53053. But then Richard Guenther guessed at the cause and Jakub Jelinek confirmed that the seemingly-infinite-loop was in fact just part of the undefined behavior we may now expect from buggy code. 2012-04-20 Jim Meyering * dispextern.h (glyph_row.used): Increase size by 1, to avoid buffer overrun in swap_glyph_pointers, which reads and writes used[LAST_AREA]. Reported as a gcc bug http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53053 where Jakub Jelinek spotted the root cause. === modified file 'src/dispextern.h' --- src/dispextern.h 2012-03-26 05:43:05 +0000 +++ src/dispextern.h 2012-04-20 11:14:29 +0000 @@ -748,7 +748,7 @@ struct glyph *glyphs[1 + LAST_AREA]; /* Number of glyphs actually filled in areas. */ - short used[LAST_AREA]; + short used[1 + LAST_AREA]; /* Window-relative x and y-position of the top-left corner of this row. If y < 0, this means that eabs (y) pixels of the row are