From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Gerd =?UTF-8?Q?M=C3=B6llmann?= Newsgroups: gmane.emacs.bugs Subject: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal Date: Sat, 24 Sep 2022 15:45:39 +0200 Message-ID: Mime-Version: 1.0 Content-Type: text/plain Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="30901"; mail-complaints-to="usenet@ciao.gmane.io" To: 58042@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sat Sep 24 15:46:29 2022 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oc5UC-0007s7-Jr for geb-bug-gnu-emacs@m.gmane-mx.org; Sat, 24 Sep 2022 15:46:28 +0200 Original-Received: from localhost ([::1]:56386 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oc5UB-0007m8-3o for geb-bug-gnu-emacs@m.gmane-mx.org; Sat, 24 Sep 2022 09:46:27 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:57590) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oc5Tm-0007lp-Uy for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 09:46:02 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:43702) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oc5Tm-0004Kp-Lz for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 09:46:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1oc5Tm-0000aE-3g for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 09:46:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Gerd =?UTF-8?Q?M=C3=B6llmann?= Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sat, 24 Sep 2022 13:46:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 58042 X-GNU-PR-Package: emacs X-Debbugs-Original-To: bug-gnu-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.16640271542220 (code B ref -1); Sat, 24 Sep 2022 13:46:01 +0000 Original-Received: (at submit) by debbugs.gnu.org; 24 Sep 2022 13:45:54 +0000 Original-Received: from localhost ([127.0.0.1]:42780 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oc5Te-0000Zk-H1 for submit@debbugs.gnu.org; Sat, 24 Sep 2022 09:45:54 -0400 Original-Received: from lists.gnu.org ([209.51.188.17]:37682) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oc5Tb-0000Za-O0 for submit@debbugs.gnu.org; Sat, 24 Sep 2022 09:45:52 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:44662) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oc5TW-0007k4-72 for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 09:45:48 -0400 Original-Received: from mail-ej1-x635.google.com ([2a00:1450:4864:20::635]:33394) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oc5TU-0004KE-C4 for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 09:45:45 -0400 Original-Received: by mail-ej1-x635.google.com with SMTP id lc7so5928764ejb.0 for ; Sat, 24 Sep 2022 06:45:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:message-id:date:subject:to:from:from:to:cc:subject :date; bh=LpScj4Ou50wnyQHrbftskh9HUrwV8Qg6iGdRyYw4T+8=; b=PuAwx+SndxPIA79dBrPz+Rttp7TIBmtbNJhbzTnwUwDxAYlf/eJeFfB7tKkaUmyrvF 8vCu2i4FFYbG+bieAu/SNOwM/CxP7f0nyRRlSJg3iocX0ciwNOOgpWGK1X3BBeAmIwTt RfollNUrl4ZAT7nq9aC+RNdX+CuLKnpLZxr9vzeAEx9zLla016DXOEs5uSjuFP6cv+AG nK76j3aJXVD8aYTT919EChC4g8UcKmEYcT6s/6zP9mO9pdvVxd249K/eTT2JySJkpy80 W84yv2omvrC5btfNove/KFtdrBRFBzep+TgK/nGnD4vrMjYA5uhkmtaeYjIAY1Wnv0Uj mWcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=mime-version:message-id:date:subject:to:from:x-gm-message-state :from:to:cc:subject:date; bh=LpScj4Ou50wnyQHrbftskh9HUrwV8Qg6iGdRyYw4T+8=; b=SoyMD9scGIu4ejyrS7IJUx4uiGHC+fBOvVpsYDGSAwvGbqtO/jbLxnR4iSnnu9k24H 1Dvv34JGxSsTaDgNnM2txHXunk4lxGCNEZJFCyUmx9DOK7ouPzakAvGQhvvGLWzOTDJX bX2RLG1cgyNziuZmkmMQE7FqTUr7BBCtP/v6m3VBOHXpPPTUIs185PW636Dhw2rh17Yp b9C5Z536yrM27FzV7CGhKPQxmUZw0wM9ntr6b9Myh8oSJMdVbm8BjV5NazKvczVNnxWr eLbt8QF+p9QibTHvGzmRgWCY9m+0wjHRnW7gaIPcx2AZ159Uu2OySvAz3Qopy+vmrocR EO5Q== X-Gm-Message-State: ACrzQf3eiNawp7qqFRDM8/SOoRgI6WTmgOTk9mwgUeqITONfDbChrWRc 0ZggZbCIUBxw+bwwgQWVVW7V3wP5ohg= X-Google-Smtp-Source: AMsMyM4JhTYTyxOQdP1eelvyPHDoiRcvV0GSmZE/lk4gHXn2IdQWciOEwG+xQByhh+Q9oE0/tlsDcw== X-Received: by 2002:a17:907:2d9e:b0:782:69f2:a0ec with SMTP id gt30-20020a1709072d9e00b0078269f2a0ecmr9567049ejc.680.1664027141829; Sat, 24 Sep 2022 06:45:41 -0700 (PDT) Original-Received: from Mini.fritz.box (p4fe3a935.dip0.t-ipconnect.de. [79.227.169.53]) by smtp.gmail.com with ESMTPSA id f2-20020a17090631c200b007826c0a05ecsm3252189ejf.209.2022.09.24.06.45.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 24 Sep 2022 06:45:41 -0700 (PDT) Received-SPF: pass client-ip=2a00:1450:4864:20::635; envelope-from=gerd.moellmann@gmail.com; helo=mail-ej1-x635.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:243535 Archived-At: In GNU Emacs 29.0.50 (build 1, aarch64-apple-darwin21.6.0, NS appkit-2113.60 Version 12.6 (Build 21G115)) of 2022-09-21 built on Mini.fritz.box Repository revision: 1231a601ebe1fd9fe454c504dbeb9267440242e7 Repository branch: master Windowing system distributor 'Apple', version 10.3.2113 System Description: macOS 12.6 Configured using: 'configure --cache-file /Users/gerd/tmp/config.cache.master --with-native-compilation' Configured features: ACL DBUS GLIB GNUTLS JSON LCMS2 LIBXML2 MODULES NATIVE_COMP NOTIFY KQUEUE NS PDUMPER PNG RSVG SQLITE3 THREADS TOOLKIT_SCROLL_BARS XIM ZLIB I got the following ASAN error today. Unfortunately, I don't have the slightest idea how to reproduce this. ==79227==ERROR: AddressSanitizer: heap-use-after-free on address 0x00011f81e7d1 at pc 0x0001005825c4 bp 0x00016fdcf370 sp 0x00016fdcf368 READ of size 1 at 0x00011f81e7d1 thread T0 #0 0x1005825c0 in re_match_2_internal regex-emacs.c:4352 #1 0x10057e5cc in rpl_re_search_2 regex-emacs.c:3383 #2 0x10057d1c4 in rpl_re_search regex-emacs.c:3177 #3 0x10056115c in fast_string_match_internal search.c:492 #4 0x1005045c0 in fast_string_match lisp.h:4818 #5 0x100504018 in Ffind_file_name_handler fileio.c:324 #6 0x1006dbe5c in openp lread.c:1911 #7 0x1006d8844 in Fload lread.c:1302 #8 0x1006e1af0 in save_match_data_load lread.c:1630 #9 0x10064f8cc in load_with_autoload_queue eval.c:2269 #10 0x10067d2f8 in Frequire fns.c:3274 previously allocated by thread T0 here: #0 0x103332ca8 in wrap_malloc+0x94 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3eca8) #1 0x1005ae8fc in lmalloc alloc.c:1361 #2 0x1005b0188 in lisp_malloc alloc.c:994 #3 0x1005b0a5c in allocate_string_data alloc.c:1889 #4 0x1005b1bd8 in make_clear_multibyte_string alloc.c:2475 #5 0x1005b1670 in make_clear_string alloc.c:2443 #6 0x1005b2714 in make_uninit_string alloc.c:2454 #7 0x100666c14 in concat_to_string fns.c:821 #8 0x100666420 in concat2 fns.c:600 #9 0x1006d7870 in Fget_load_suffixes lread.c:1123 #10 0x1006d86ac in Fload lread.c:1296 #11 0x1006e1af0 in save_match_data_load lread.c:1630 #12 0x10064f8cc in load_with_autoload_queue eval.c:2269 rame #5: 0x00000001005825c4 emacs`re_match_2_internal(bufp=0x000000010111b890, string1=0x0000000000000000, size1=0, string2="/Users/gerd/.config/emacs.d.default/elpa/company-0.9.13/lsp-protocol.el.gz", size2=74, pos=0, regs=0x0000000000000000, stop=74) at regex-emacs.c:4352:18 4349 4350 PREFETCH (); 4351 int len; -> 4352 int corig = RE_STRING_CHAR_AND_LENGTH (d, len, target_multibyte); 4353 int c = corig; 4354 if (target_multibyte) 4355 { And to make things worse, I can't get an xbacktrace because the "new" lldb, which I got with Xcode 14, says it has a bug. Tadah :-/. (lldb) xbacktrace PLEASE submit a bug report to https://developer.apple.com/bug-reporting/ and include the crash backtrace. Stack dump: