From: "Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
To: Eli Zaretskii <eliz@gnu.org>
Cc: 51105@debbugs.gnu.org
Subject: bug#51105: 29.0.50; Buffer overflow bug in ns_compute_glyph_string_overhangs
Date: Sat, 09 Oct 2021 12:06:36 +0200 [thread overview]
Message-ID: <m1r1cu4imr.fsf@yahoo.es> (raw)
In-Reply-To: <83bl3yya46.fsf@gnu.org> (Eli Zaretskii's message of "Sat, 09 Oct 2021 09:40:09 +0300")
Eli Zaretskii <eliz@gnu.org> writes:
>> Date: Sat, 09 Oct 2021 02:30:33 +0200
>> From: Daniel Martín via "Bug reports for GNU Emacs,
>> the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
>>
>> 2) The root cause of the issue may be that s->nchars is 0 when it
>> shouldn't. Is there any legitimate scenario where the display engine
>> may call this routine with s->nchars equal to 0? If so, what are those
>> situations?
>
> I think if the glyph string has composition glyphs, nchars can be
> zero. What is the value of s->first_glyph->type in the case where it
> happens?
Yep, it seems so:
(lldb) fr v s->first_glyph->type
(unsigned int:3) s->first_glyph->type = 1
I've found a 2006 commit that seemed to handle this particular pointer
arithmetic logic for when the type of the first glyph is STRETCH_GLYPH:
https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=825de9a1027073beaec38ab1572e9d954f8a1eb0
Now I think that the right thing to do may be to modify nsterm.m, switch
on the glyph type and, if the glyph type is COMPOSITE_GLYPH, call
composition_gstring_width to get the glyph metrics. Function
composition_gstring_width uses the values from fields s->cmp_from and
s->cmp_to, and would avoid the buffer overflow:
(lldb) fr v s->cmp_from
(int) s->cmp_from = 6
(lldb) fr v s->cmp_to
(int) s->cmp_to = 7
WDYT? I can prepare a patch of this type if you agree.
I'll try to get the sequence of codepoints from the glyph string in the
debugger, so we can have a reduced test case (ie. the exact string from
the Wikipedia's front page that causes the issue).
next prev parent reply other threads:[~2021-10-09 10:06 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <m17den59au.fsf.ref@yahoo.es>
2021-10-09 0:30 ` bug#51105: 29.0.50; Buffer overflow bug in ns_compute_glyph_string_overhangs Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors
2021-10-09 6:40 ` Eli Zaretskii
2021-10-09 10:06 ` Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors [this message]
2021-10-09 11:43 ` Eli Zaretskii
2021-10-09 13:57 ` Alan Third
2021-10-09 19:35 ` Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors
2021-10-09 19:41 ` Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors
2021-11-05 2:39 ` Lars Ingebrigtsen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m1r1cu4imr.fsf@yahoo.es \
--to=bug-gnu-emacs@gnu.org \
--cc=51105@debbugs.gnu.org \
--cc=eliz@gnu.org \
--cc=mardani29@yahoo.es \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).