bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[Sergei Litvin]

[-- Attachment #1: Type: text/plain, Size: 1092 bytes --]

Package: emacs

Version: 24.5

struct position *
compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
         EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
         EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
         ptrdiff_t hscroll, int tab_offset, struct window *win)
{

...

   if (dp == buffer_display_table ())
     width_table = (VECTORP (BVAR (current_buffer, width_table))
                    ? XVECTOR (BVAR (current_buffer, width_table))->contents
                    : 0);
   else
     /* If the window has its own display table, we can't use the width
        run cache, because that's based on the buffer's display table.  */
     width_table = 0; // initialize it with 0 (current buffer has no 
display table)

...

       if (width_cache)
         {
           /* Is this character part of the current run?  If so, extend
          the run.  */
           if (pos - 1 == width_run_end
           && XFASTINT (width_table[c]) == width_run_width) // 
dereference width_table here, and crash
         width_run_end = pos;
...


Sergei Litvin


[-- Attachment #2: Type: text/html, Size: 1827 bytes --]

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[Eli Zaretskii]

> From: Sergei Litvin <litvindev@gmail.com>
> Date: Mon, 25 Jul 2016 02:51:40 +0300
> 
> 
> struct position *
> compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
> EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
> EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
> ptrdiff_t hscroll, int tab_offset, struct window *win)
> {
> 
> ...
> 
> if (dp == buffer_display_table ())
> width_table = (VECTORP (BVAR (current_buffer, width_table))
> ? XVECTOR (BVAR (current_buffer, width_table))->contents
> : 0);
> else
> /* If the window has its own display table, we can't use the width
> run cache, because that's based on the buffer's display table. */
> width_table = 0; // initialize it with 0 (current buffer has no display table)
> 
> ...
> 
> if (width_cache)
> {
> /* Is this character part of the current run? If so, extend
> the run. */
> if (pos - 1 == width_run_end
> && XFASTINT (width_table[c]) == width_run_width) // dereference width_table here, and crash
> width_run_end = pos;

Did you actually see such a crash, and if so, can you show a recipe
for reproducing that?

Thanks.

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[Sergei Litvin]

[-- Attachment #1: Type: text/plain, Size: 1363 bytes --]

I've prepared an elisp file to reproduce a crash:

1) Open it and move cursor to the end of the file

2) Execute eval-buffer

3) Press C-l several times


Sergei Litvin


On 07/25/2016 07:24 PM, Eli Zaretskii wrote:
>> From: Sergei Litvin <litvindev@gmail.com>
>> Date: Mon, 25 Jul 2016 02:51:40 +0300
>>
>>
>> struct position *
>> compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
>> EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
>> EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
>> ptrdiff_t hscroll, int tab_offset, struct window *win)
>> {
>>
>> ...
>>
>> if (dp == buffer_display_table ())
>> width_table = (VECTORP (BVAR (current_buffer, width_table))
>> ? XVECTOR (BVAR (current_buffer, width_table))->contents
>> : 0);
>> else
>> /* If the window has its own display table, we can't use the width
>> run cache, because that's based on the buffer's display table. */
>> width_table = 0; // initialize it with 0 (current buffer has no display table)
>>
>> ...
>>
>> if (width_cache)
>> {
>> /* Is this character part of the current run? If so, extend
>> the run. */
>> if (pos - 1 == width_run_end
>> && XFASTINT (width_table[c]) == width_run_width) // dereference width_table here, and crash
>> width_run_end = pos;
> Did you actually see such a crash, and if so, can you show a recipe
> for reproducing that?
>
> Thanks.


[-- Attachment #2: emacs-crash.el --]
[-- Type: text/x-emacs-lisp, Size: 470 bytes --]

(set-window-display-table (selected-window) #^[nil nil display-table nil nil nil nil nil nil nil nil nil nil nil
 nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil
 nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil
 nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil
 nil nil nil nil nil nil nil nil nil])
(set-buffer-multibyte nil)
; 1) Move cursor to this line
; 2) Execute eval-buffer
; 3) Press C-l several times

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[Clément Pit--Claudel]

[-- Attachment #1.1: Type: text/plain, Size: 1640 bytes --]

On 2016-07-25 18:02, Sergei Litvin wrote:
> I've prepared an elisp file to reproduce a crash:
> 
> 1) Open it and move cursor to the end of the file
> 2) Execute eval-buffer
> 3) Press C-l several times

Running this recipe does not cause a crash for me in GNU Emacs 25.1.50.7 (x86_64-pc-linux-gnu, GTK+ Version 3.18.9) of 2016-07-20.  Am I missing something?

> On 07/25/2016 07:24 PM, Eli Zaretskii wrote:
>>> From: Sergei Litvin <litvindev@gmail.com>
>>> Date: Mon, 25 Jul 2016 02:51:40 +0300
>>>
>>>
>>> struct position *
>>> compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
>>> EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
>>> EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
>>> ptrdiff_t hscroll, int tab_offset, struct window *win)
>>> {
>>>
>>> ...
>>>
>>> if (dp == buffer_display_table ())
>>> width_table = (VECTORP (BVAR (current_buffer, width_table))
>>> ? XVECTOR (BVAR (current_buffer, width_table))->contents
>>> : 0);
>>> else
>>> /* If the window has its own display table, we can't use the width
>>> run cache, because that's based on the buffer's display table. */
>>> width_table = 0; // initialize it with 0 (current buffer has no display table)
>>>
>>> ...
>>>
>>> if (width_cache)
>>> {
>>> /* Is this character part of the current run? If so, extend
>>> the run. */
>>> if (pos - 1 == width_run_end
>>> && XFASTINT (width_table[c]) == width_run_width) // dereference width_table here, and crash
>>> width_run_end = pos;
>> Did you actually see such a crash, and if so, can you show a recipe
>> for reproducing that?
>>
>> Thanks.
> 


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[npostavs]

Clément Pit--Claudel <clement.pit@gmail.com> writes:

> On 2016-07-25 18:02, Sergei Litvin wrote:
>> I've prepared an elisp file to reproduce a crash:
>> 
>> 1) Open it and move cursor to the end of the file
>> 2) Execute eval-buffer
>> 3) Press C-l several times
>
> Running this recipe does not cause a crash for me in GNU Emacs 25.1.50.7 (x86_64-pc-linux-gnu, GTK+ Version 3.18.9) of 2016-07-20.  Am I missing something?

It crashes for me on 24.5, but not on 25.0.95.  Perhaps it was fixed?

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[Clément Pit--Claudel]

[-- Attachment #1.1: Type: text/plain, Size: 636 bytes --]

On 2016-07-25 22:33, npostavs@users.sourceforge.net wrote:
> Clément Pit--Claudel <clement.pit@gmail.com> writes:
> 
>> On 2016-07-25 18:02, Sergei Litvin wrote:
>>> I've prepared an elisp file to reproduce a crash:
>>>
>>> 1) Open it and move cursor to the end of the file
>>> 2) Execute eval-buffer
>>> 3) Press C-l several times
>>
>> Running this recipe does not cause a crash for me in GNU Emacs 25.1.50.7 (x86_64-pc-linux-gnu, GTK+ Version 3.18.9) of 2016-07-20.  Am I missing something?
> 
> It crashes for me on 24.5, but not on 25.0.95.  Perhaps it was fixed?

Indeed, same here. Crashes on 24.5, but not 25.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[Eli Zaretskii]

> From: Clément Pit--Claudel <clement.pit@gmail.com>
> Date: Mon, 25 Jul 2016 22:49:35 -0400
> Cc: 24064@debbugs.gnu.org
> 
> >>> I've prepared an elisp file to reproduce a crash:
> >>>
> >>> 1) Open it and move cursor to the end of the file
> >>> 2) Execute eval-buffer
> >>> 3) Press C-l several times
> >>
> >> Running this recipe does not cause a crash for me in GNU Emacs 25.1.50.7 (x86_64-pc-linux-gnu, GTK+ Version 3.18.9) of 2016-07-20.  Am I missing something?
> > 
> > It crashes for me on 24.5, but not on 25.0.95.  Perhaps it was fixed?
> 
> Indeed, same here. Crashes on 24.5, but not 25.

C-l (a.k.a. "recenter") no longer calls compute_motion in Emacs 25, so
to trigger the segfault, the recipe should be changed like this:

 1) Open it and move cursor to the end of the file
 2) Execute eval-buffer
 3) Type "M-x set-variable RET scroll-preserve-screen-position RET t RET"
 4) Type "C-u 1 C-v"

In addition, the above should be done on a TTY frame.

This 22-year old bug is now fixed on the master branch.

Thanks.

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[Clément Pit--Claudel]

[-- Attachment #1.1: Type: text/plain, Size: 112 bytes --]

On 2016-07-26 11:35, Eli Zaretskii wrote:
> This 22-year old bug is now fixed on the master branch.

! :)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]