From: Steve Kemp <steve@steve.org.uk>
To: 27585@debbugs.gnu.org
Subject: bug#27585: segfault when evaluating a file containing only backticks
Date: Wed, 05 Jul 2017 06:21:10 +0000 [thread overview]
Message-ID: <1499235670.28433.1@ssh.steve.org.uk> (raw)
I've recently started fuzzing GNU Emacs, using the current git sources.
During the course of that work I stumbled upon this easily reproduced bug:
deagol ~ $ perl -e 'print "`" x ( 1024 * 1024 * 12);' > t.el
deagol ~ $ /usr/bin/emacs --batch --script ./t.el
..
Segmentation fault (core dumped)
(So I'm trying to call "emacs --batch --script $file" where the file
contains thousands of repeated backtick-characters.)
Because I've built from source I can see this backtrace:
#5 handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>)
at sysdep.c:1811
#6 <signal handler called>
#7 read1 (readcharfun=readcharfun@entry=35581829,
pch=pch@entry=0x7ffcc661e010, first_in_list=first_in_list@entry=false)
at lread.c:2923
#8 0x0000000000ad8cda in read0 (readcharfun=35581829) at lread.c:2220
#9 read1 (readcharfun=readcharfun@entry=35581829,
pch=pch@entry=0x7ffcc66220c0, first_in_list=first_in_list@entry=false)
at lread.c:3149
#10 0x0000000000ad8cda in read0 (readcharfun=35581829) at lread.c:2220
#11 read1 (readcharfun=readcharfun@entry=35581829,
pch=pch@entry=0x7ffcc6626170, first_in_list=first_in_list@entry=false)
at lread.c:3149
#12 0x0000000000ad8cda in read0 (readcharfun=35581829) at lread.c:2220
#13 read1 (readcharfun=readcharfun@entry=35581829,
pch=pch@entry=0x7ffcc662a220, first_in_list=first_in_list@entry=false)
at lread.c:3149
#14 0x0000000000ad8cda in read0 (readcharfun=35581829) at lread.c:2220
#15 read1 (readcharfun=readcharfun@entry=35581829,
pch=pch@entry=0x7ffcc662e2d0, first_in_list=first_in_list@entry=false)
at lread.c:3149
#16 0x0000000000ad8cda in read0 (readcharfun=35581829) at lread.c:2220
#17 read1 (readcharfun=readcharfun@entry=35581829,
pch=pch@entry=0x7ffcc6632380, first_in_list=first_in_list@entry=false)
at lread.c:3149
#18 0x0000000000ad8cda in read0 (readcharfun=35581829) at lread.c:2220
#19 read1 (readcharfun=readcharfun@entry=35581829,
pch=pch@entry=0x7ffcc6636430, first_in_list=first_in_list@entry=false)
at lread.c:3149
#20 0x0000000000ad8cda in read0 (readcharfun=35581829) at lread.c:2220
#21 read1 (readcharfun=readcharfun@entry=35581829,
pch=pch@entry=0x7ffcc663a4e0, first_in_list=first_in_list@entry=false)
at lread.c:3149
....
I've replicated this upon the package of GNU Emacs as available to
the old-stable/jessie release of Debian GNU/Linux, which identifies
itself as:
In GNU Emacs 24.5.1 (x86_64-pc-linux-gnu, GTK+ Version 3.14.5)
of 2016-03-19 on trouble, modified by Debian
Windowing system distributor `The X.Org Foundation', version 11.0.11604000
System Description: Debian GNU/Linux 8.8 (jessie)
Configured using:
`configure --build x86_64-linux-gnu --prefix=/usr
--sharedstatedir=/var/lib --libexecdir=/usr/lib
--localstatedir=/var/lib --infodir=/usr/share/info
--mandir=/usr/share/man --with-pop=yes
--enable-locallisppath=/etc/emacs24:/etc/emacs:/usr/local/share/emacs/24.5/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/24.5/site-lisp:/usr/share/emacs/site-lisp
--build x86_64-linux-gnu --prefix=/usr --sharedstatedir=/var/lib
--libexecdir=/usr/lib --localstatedir=/var/lib
--infodir=/usr/share/info --mandir=/usr/share/man --with-pop=yes
--enable-locallisppath=/etc/emacs24:/etc/emacs:/usr/local/share/emacs/24.5/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/24.5/site-lisp:/usr/share/emacs/site-lisp
--with-x=yes --with-x-toolkit=gtk3 --with-toolkit-scroll-bars
'CFLAGS=-g -O2 -fstack-protector-strong -Wformat
-Werror=format-security -Wall' CPPFLAGS=-D_FORTIFY_SOURCE=2
LDFLAGS=-Wl,-z,relro'
My current-git build reports as:
In GNU Emacs 26.0.50 (build 1, x86_64-pc-linux-gnu)
of 2017-07-05 built on kernel.default.skx.uk0.bigv.io
Repository revision: 5d62247323f53f3ae9c7d9f51e951635887b2fb6
Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list...
Configured using:
'configure --prefix=/tmp/emacs/ --without-makeinfo --with-gnutls=no'
Configured features:
SOUND NOTIFY ZLIB
Important settings:
value of $LC_ALL: en_US.UTF8
value of $LANG: en_GB.UTF-8
locale-coding-system: utf-8-unix
"Obviously" this same bug can be reproduced inside emacs:
1. Open Emacs.
2. Create a new buffer.
3. Fill the buffer with `
4. Ctrl-x h
5. M-x eval-region
Steve
--
https://www.steve.org.uk/
next reply other threads:[~2017-07-05 6:21 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-05 6:21 Steve Kemp [this message]
2017-07-05 7:51 ` bug#27585: segfault when evaluating a file containing only backticks Andreas Schwab
2017-07-05 8:26 ` Steve Kemp
2017-07-05 18:41 ` Eli Zaretskii
2017-07-05 18:55 ` Steve Kemp
2017-07-05 19:47 ` Eli Zaretskii
2017-07-06 3:46 ` Steve Kemp
2017-07-06 15:16 ` Eli Zaretskii
2017-07-06 15:33 ` Steve Kemp
2017-07-06 16:24 ` Eli Zaretskii
2017-07-06 6:46 ` Andreas Schwab
2017-07-06 15:19 ` Eli Zaretskii
2017-07-06 15:31 ` Andreas Schwab
2017-07-06 15:37 ` Eli Zaretskii
2017-07-06 15:41 ` Andreas Schwab
2017-07-06 15:52 ` Daniel Colascione
2017-07-06 16:19 ` Eli Zaretskii
2017-07-06 16:37 ` Daniel Colascione
2017-07-06 17:27 ` Eli Zaretskii
2017-07-06 15:48 ` Daniel Colascione
2017-07-14 12:09 ` Paul Eggert
2017-07-14 13:30 ` Eli Zaretskii
2017-07-15 5:03 ` Steve Kemp
2017-07-15 5:12 ` Paul Eggert
2017-07-15 7:15 ` Eli Zaretskii
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1499235670.28433.1@ssh.steve.org.uk \
--to=steve@steve.org.uk \
--cc=27585@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.