bug#45122: [PATCH] 27.1; 28.0.50; Fix crash (segfault) in etags on generating tags for Erlang files

bug#45122: [PATCH] 27.1; 28.0.50; Fix crash (segfault) in etags on generating tags for Erlang files

[serge.tupchii via Bug reports for GNU Emacs, the Swiss army knife of text editors]

[-- Attachment #1: Type: text/plain, Size: 1669 bytes --]

Hi,

This is a trivial patch to fix segfault occurring when generating tags for Erlang source files.


Steps to reproduce:

 1. $ wget https://erlang.org/download/otp_src_23.1.tar.gz  (~85 Mb)
 2. $ tar -xf otp_src_23.1.tar.gz
 3. $ etags otp_src_23.1/lib/*/src/*.erl
   Segmentation fault (core dumped)

In GNU Emacs 28.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.18.9, cairo version 1.14.6)
 of 2020-11-30 built on sergey-Latitude-5480
Repository revision: 31dcc70e555482fee59df2d8aa1939360d8f8c69
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.11906000
System Description: Ubuntu 16.04.7 LTS

Note: this bug is also present in Emacs 27 release

GDB backtrace:
(gdb) bt
#0  0x00007ffff7b5b48d in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x000000000040a7bd in mempcpy (__len=12, __src=<optimized out>, __dest=0x0)
    at /usr/include/x86_64-linux-gnu/bits/string3.h:67
#2  memcpyz (len=<optimized out>, src=<optimized out>, dest=0x0) at etags.c:149
#3  Erlang_functions (inf=0x6280a0) at etags.c:6082
#4  0x000000000040c003 in find_entries (inf=inf@entry=0x6280a0) at etags.c:1901
#5  0x000000000040c75e in process_file (fh=fh@entry=0x6280a0,
    fn=fn@entry=0x7fffffff644c "otp_src_23.1/lib/asn1/src/asn1ct_check.erl", lang=lang@entry=0x0)
    at etags.c:1722
#6  0x000000000040c9e0 in process_file_name (
    file=0x7fffffff644c "otp_src_23.1/lib/asn1/src/asn1ct_check.erl", lang=0x0) at etags.c:1668
#7  0x0000000000401c0c in main (argc=<optimized out>, argv=<optimized out>) at etags.c:1313


The attached patch fixes the above issue.

Thanks and kind regards,
Serge

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-Fix-crash-segfault-in-etags-on-generating-tags-for-E.patch --]
[-- Type: text/x-patch; name=0001-Fix-crash-segfault-in-etags-on-generating-tags-for-E.patch, Size: 738 bytes --]

From 366f5570f44a74f60dcf6f0b0cc5c5878a48e2d4 Mon Sep 17 00:00:00 2001
From: Serge Tupchii <serge.tupchii@protonmail.com>
Date: Tue, 8 Dec 2020 11:25:01 +0200
Subject: [PATCH] Fix crash (segfault) in etags on generating tags for Erlang
 files

* lib-src/etags.c: Set allocated and lastlen to zero, after freeing last ptr
  in Erlang_functions to prevent dereferencing NULL pointer
---
 lib-src/etags.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib-src/etags.c b/lib-src/etags.c
index 4315771a49..a1c6837e88 100644
--- a/lib-src/etags.c
+++ b/lib-src/etags.c
@@ -6063,6 +6063,7 @@ Erlang_functions (FILE *inf)
 	    {
 	      free (last);
 	      last = NULL;
+	      allocated = lastlen = 0;
 	    }
 	}
       else
-- 
2.29.0

bug#45122: [PATCH] 27.1; 28.0.50; Fix crash (segfault) in etags on generating tags for Erlang files

[Lars Ingebrigtsen]

"serge.tupchii" <serge.tupchii@protonmail.com> writes:

> This is a trivial patch to fix segfault occurring when generating tags
> for Erlang source files.

Thanks; applied to Emacs 28.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no