From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Noam Postavsky Newsgroups: gmane.emacs.bugs Subject: bug#30481: 26.0.91; infinite recursion + edebug = memory corruption Date: Thu, 15 Feb 2018 22:38:10 -0500 Message-ID: <87sha17gf1.fsf_-_@gmail.com> References: <87shaun9ix.fsf@users.sourceforge.net> <87po5ymqed.fsf@users.sourceforge.net> <874lnafeun.fsf@gmx.de> <87mv12m3q6.fsf@users.sourceforge.net> <877es528vp.fsf@gmx.de> <87h8r9mlxx.fsf@users.sourceforge.net> NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" X-Trace: blaine.gmane.org 1518752239 30040 195.159.176.226 (16 Feb 2018 03:37:19 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Fri, 16 Feb 2018 03:37:19 +0000 (UTC) User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.0.90 (gnu/linux) To: 30481@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Fri Feb 16 04:37:14 2018 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1emWpi-0007EM-8w for geb-bug-gnu-emacs@m.gmane.org; Fri, 16 Feb 2018 04:37:10 +0100 Original-Received: from localhost ([::1]:34285 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1emWrk-00089R-CN for geb-bug-gnu-emacs@m.gmane.org; Thu, 15 Feb 2018 22:39:16 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:44864) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1emWrb-000882-L4 for bug-gnu-emacs@gnu.org; Thu, 15 Feb 2018 22:39:08 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1emWrW-0005Yd-KA for bug-gnu-emacs@gnu.org; Thu, 15 Feb 2018 22:39:07 -0500 Original-Received: from debbugs.gnu.org ([208.118.235.43]:37576) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1emWrW-0005YW-FF for bug-gnu-emacs@gnu.org; Thu, 15 Feb 2018 22:39:02 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1emWrW-0003W4-8w for bug-gnu-emacs@gnu.org; Thu, 15 Feb 2018 22:39:02 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Noam Postavsky Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Fri, 16 Feb 2018 03:39:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 30481 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch X-Debbugs-Original-To: bug-gnu-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.151875230713471 (code B ref -1); Fri, 16 Feb 2018 03:39:02 +0000 Original-Received: (at submit) by debbugs.gnu.org; 16 Feb 2018 03:38:27 +0000 Original-Received: from localhost ([127.0.0.1]:45473 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1emWqx-0003VC-9R for submit@debbugs.gnu.org; Thu, 15 Feb 2018 22:38:27 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:53265) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1emWqw-0003V0-5q for submit@debbugs.gnu.org; Thu, 15 Feb 2018 22:38:26 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1emWqp-0005ED-Tz for submit@debbugs.gnu.org; Thu, 15 Feb 2018 22:38:21 -0500 Original-Received: from lists.gnu.org ([2001:4830:134:3::11]:51659) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1emWqp-0005E6-Pe for submit@debbugs.gnu.org; Thu, 15 Feb 2018 22:38:19 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:44198) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1emWqo-0007Do-F2 for bug-gnu-emacs@gnu.org; Thu, 15 Feb 2018 22:38:19 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1emWqk-0005BH-M5 for bug-gnu-emacs@gnu.org; Thu, 15 Feb 2018 22:38:18 -0500 Original-Received: from mail-io0-x22b.google.com ([2607:f8b0:4001:c06::22b]:43892) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1emWqk-0005Ac-Fg for bug-gnu-emacs@gnu.org; Thu, 15 Feb 2018 22:38:14 -0500 Original-Received: by mail-io0-x22b.google.com with SMTP id 72so2892426iom.10 for ; Thu, 15 Feb 2018 19:38:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:references:date:in-reply-to:message-id:user-agent :mime-version; bh=4NXUFwPGofQ2kgM5cx7E2mFgwNJn8YEmFXtd8UAY3ko=; b=rD8dLw3G/Ufh/ASgNEwZ8i/pfh3PSBYkFonxxJsJwK3cPmNpAtHUIHjEVtw3CItYWa uJ/EC19e4KzNo8rp2hWMcLVJEzu5AGKSEhkU2SrOiwSS74yIlgxGvXJZ+b+eddU2QLZG 1vntUxYhvxBM5G/B3wmmvlS8O7EnQGTBSUCDFIlQyXA/gC02v+D6paGX7HrWz7CPZUMI oByI7eWQvDZGTktRIdHDO3kVOr0OkaYv/N7e8mfrS4Jz3zKTMdgkfyP4hM48S9HV/5ab D6uFU6T3tzg0Z2wxNzIgZedbLNWlKMe4gZBYWXTXaypR9kFCVgai3ornilbkyl4sIs87 WyNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:references:date:in-reply-to :message-id:user-agent:mime-version; bh=4NXUFwPGofQ2kgM5cx7E2mFgwNJn8YEmFXtd8UAY3ko=; b=Fkyhs5D2FAphJgRXWPPQLpo9BLTZFfusIrV4v5NDU6VeRTNIKU68OvXMwkp+xpNlhU kPeKAhUWE9NxgvLMFhYPfdWaH93tU25QSkTb9ZiGnCnB2EV21Lsz0fPbipnxjfpvk/+0 bAsOA1/Kz/dUvxC1zazVfJtIfsGvlLmPo1TOutd44oCTxnv1vCpuT/Kru81aEtoqAU68 Hy7etZfSg7iYCJHRkqqmRscHpBfd+h+8WGHcveMO2pwKe5NQ04NvCW45hgwHXK8KsK0t frqp/sL848TAN2Pwn/xswc3yDi1xMx5xQzuTrNG2RzZaS07IFI0xPKdMCA/HS/qbDWGR 2sOg== X-Gm-Message-State: APf1xPBh3UHBOZsUosHDx9JvypVmOT5i2hX6XbSoA3p3bqjDSplYiQzu ZSwUhG1epRnrWv9MJhT69imoWQ== X-Google-Smtp-Source: AH8x226S9YAnWyUmVekm0J6mQZ590MBmnofP0Tbqwq9jeDB0kLdA1V74B4kc5sszffydV7qfAmkMaw== X-Received: by 10.107.178.70 with SMTP id b67mr6791707iof.55.1518752293037; Thu, 15 Feb 2018 19:38:13 -0800 (PST) Original-Received: from zebian (cbl-45-2-119-34.yyz.frontiernetworks.ca. [45.2.119.34]) by smtp.googlemail.com with ESMTPSA id s32sm1388313ite.1.2018.02.15.19.38.11 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 15 Feb 2018 19:38:11 -0800 (PST) In-Reply-To: <87h8r9mlxx.fsf@users.sourceforge.net> (Noam Postavsky's message of "Thu, 25 Jan 2018 20:46:18 -0500") X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:143333 Archived-At: --=-=-= Content-Type: text/plain Tags: patch Picking up on a side issue from Bug#30243: >>> emacs: malloc.c:2427: sysmalloc: Assertion `(old_top == initial_top >>> (av) && old_size == 0) || ((unsigned long) (old_size) >= MINSIZE && >>> prev_inuse (old_top) && ((unsigned long) old_end & (pagesize - 1)) >>> == 0)' failed. >>> Fatal error 6: Aborted > The problem appears to be that we hit the limit in grow_specpdl(), > and then call signal_error which does Ffuncall and then > record_in_backtrace writes to specdl, this latter write is invalid > since we failed to grow specdl before. Thus memory corruption, > undefined behaviour, etc. > > #0 0x000000000063999d in record_in_backtrace (function=XIL(0xd9ea380), args=0xffef5b188, nargs=2) > at ../../src/eval.c:2096 > #1 0x000000000063b8c9 in Ffuncall (nargs=3, args=0xffef5b180) at ../../src/eval.c:2746 > #2 0x000000000063b320 in call2 (fn=XIL(0xd9ea380), arg1=XIL(0x5250), arg2=XIL(0x1161fc03)) > at ../../src/eval.c:2625 > #3 0x00000000006381db in signal_or_quit (error_symbol=XIL(0x5250), data=XIL(0x1161fc03), > keyboard_quit=false) at ../../src/eval.c:1565 > #4 0x000000000063806d in Fsignal (error_symbol=XIL(0x5250), data=XIL(0x1161fc03)) > at ../../src/eval.c:1514 > #5 0x000000000057939a in xsignal (error_symbol=XIL(0x5250), data=XIL(0x1161fc03)) > at ../../src/lisp.h:3861 > #6 0x0000000000638704 in signal_error (s=0x75e388 "Variable binding depth exceeds max-specpdl-size", > arg=XIL(0)) at ../../src/eval.c:1688 > #7 0x00000000006398cd in grow_specpdl () at ../../src/eval.c:2080 > (More stack frames follow...) A simple reproducer from emacs -Q, C-u C-M-x on the following: (defun foo () (let ((x 1)) (foo))) then evaluate (foo) and git 'g' to continue until the "Variable binding depth exceeds max-specpdl-size" error. At that point the memory corruption has happened (verified with valgrind), although I found I had to split window to actually trigger the malloc assertion. The following patch solves the problem by not calling signal-hook-function when the specpdl array is exhausted. I think it could be safe for emacs-26. --=-=-= Content-Type: text/x-diff Content-Disposition: inline; filename=v1-0001-Avoid-memory-corruption-with-lisp-stack-overflow-.patch Content-Description: patch >From c9a183b31dce87803dad3d5feccf561fe3f63c9b Mon Sep 17 00:00:00 2001 From: Noam Postavsky Date: Thu, 15 Feb 2018 22:13:51 -0500 Subject: [PATCH v1] Avoid memory corruption with lisp stack overflow + edebug If grow_specpdl fails due to outgrowing max_specpdl_size, it will signal an error *before* growing the specpdl array. Therefore, when handling the signal, specpdl_ptr points past the end of the specpdl array and any further use of of specpdl before unwinding (e.g., if edebug binds signal-hook-function) will cause memory corruption. * src/eval.c (signal_or_quit): Don't call `signal-hook-function' if the specpdl_ptr is already past the end of the specpdl array. --- src/eval.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/eval.c b/src/eval.c index e05a17f7b4..ca1eb84ff3 100644 --- a/src/eval.c +++ b/src/eval.c @@ -1553,7 +1553,10 @@ signal_or_quit (Lisp_Object error_symbol, Lisp_Object data, bool keyboard_quit) /* This hook is used by edebug. */ if (! NILP (Vsignal_hook_function) - && ! NILP (error_symbol)) + && ! NILP (error_symbol) + /* Don't try to call a lisp function if we've already overflowed + the specpdl stack. */ + && specpdl_ptr < specpdl + specpdl_size) { /* Edebug takes care of restoring these variables when it exits. */ if (lisp_eval_depth + 20 > max_lisp_eval_depth) -- 2.11.0 --=-=-=--