From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#11288: avoid buffer overrun in display code Date: Fri, 20 Apr 2012 17:10:53 +0300 Message-ID: <834nseijde.fsf@gnu.org> References: <87397yljea.fsf@rho.meyering.net> Reply-To: Eli Zaretskii NNTP-Posting-Host: plane.gmane.org X-Trace: dough.gmane.org 1334931123 24850 80.91.229.3 (20 Apr 2012 14:12:03 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Fri, 20 Apr 2012 14:12:03 +0000 (UTC) Cc: jakub@redhat.com, richard.guenther@gmail.com, 11288-done@debbugs.gnu.org To: Jim Meyering Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Fri Apr 20 16:11:58 2012 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1SLEYz-0000rE-Uo for geb-bug-gnu-emacs@m.gmane.org; Fri, 20 Apr 2012 16:11:54 +0200 Original-Received: from localhost ([::1]:33911 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLEYv-0005VL-CI for geb-bug-gnu-emacs@m.gmane.org; Fri, 20 Apr 2012 10:11:49 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:36880) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLEYp-0005V1-7n for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 10:11:48 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SLEYk-0001AY-57 for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 10:11:42 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:43373) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SLEYk-0001AL-16 for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 10:11:38 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.72) (envelope-from ) id 1SLEZ8-0003Hd-6x for bug-gnu-emacs@gnu.org; Fri, 20 Apr 2012 10:12:02 -0400 Resent-From: Eli Zaretskii Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-To: bug-gnu-emacs@gnu.org Resent-Date: Fri, 20 Apr 2012 14:12:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: cc-closed 11288 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: Mail-Followup-To: 11288@debbugs.gnu.org, eliz@gnu.org Original-Received: via spool by 11288-done@debbugs.gnu.org id=D11288.133493108512565 (code D ref 11288); Fri, 20 Apr 2012 14:12:01 +0000 Original-Received: (at 11288-done) by debbugs.gnu.org; 20 Apr 2012 14:11:25 +0000 Original-Received: from localhost ([127.0.0.1]:44406 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.72) (envelope-from ) id 1SLEYX-0003Gc-4C for submit@debbugs.gnu.org; Fri, 20 Apr 2012 10:11:25 -0400 Original-Received: from mtaout22.012.net.il ([80.179.55.172]:36548) by debbugs.gnu.org with esmtp (Exim 4.72) (envelope-from ) id 1SLEYU-0003GM-8f for 11288-done@debbugs.gnu.org; Fri, 20 Apr 2012 10:11:23 -0400 Original-Received: from conversion-daemon.a-mtaout22.012.net.il by a-mtaout22.012.net.il (HyperSendmail v2007.08) id <0M2S006007BMWG00@a-mtaout22.012.net.il> for 11288-done@debbugs.gnu.org; Fri, 20 Apr 2012 17:10:50 +0300 (IDT) Original-Received: from HOME-C4E4A596F7 ([84.229.172.156]) by a-mtaout22.012.net.il (HyperSendmail v2007.08) with ESMTPA id <0M2S0052D7E1QCM0@a-mtaout22.012.net.il>; Fri, 20 Apr 2012 17:10:50 +0300 (IDT) In-reply-to: <87397yljea.fsf@rho.meyering.net> X-012-Sender: halo1@inter.net.il X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.13 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:59320 Archived-At: > From: Jim Meyering > Date: Fri, 20 Apr 2012 13:42:05 +0200 > Cc: Jakub Jelinek , > Richard Guenther > > This bug leads to a seemingly unterminated loop in swap_glyph_pointers, > when compiled with gcc-4.8.0 (from April 19 or newer). > At first I thought it was a code-gen bug and reported it as > http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53053. But then Richard > Guenther guessed at the cause and Jakub Jelinek confirmed that the > seemingly-infinite-loop was in fact just part of the undefined behavior > we may now expect from buggy code. > > 2012-04-20 Jim Meyering > > * dispextern.h (glyph_row.used): Increase size by 1, to avoid buffer > overrun in swap_glyph_pointers, which reads and writes used[LAST_AREA]. > Reported as a gcc bug http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53053 > where Jakub Jelinek spotted the root cause. > > === modified file 'src/dispextern.h' > --- src/dispextern.h 2012-03-26 05:43:05 +0000 > +++ src/dispextern.h 2012-04-20 11:14:29 +0000 > @@ -748,7 +748,7 @@ > struct glyph *glyphs[1 + LAST_AREA]; > > /* Number of glyphs actually filled in areas. */ > - short used[LAST_AREA]; > + short used[1 + LAST_AREA]; > > /* Window-relative x and y-position of the top-left corner of this > row. If y < 0, this means that eabs (y) pixels of the row are Thanks, I fixed it somewhat differently, see below. === modified file 'src/ChangeLog' --- src/ChangeLog 2012-04-20 06:39:29 +0000 +++ src/ChangeLog 2012-04-20 14:07:46 +0000 @@ -1,3 +1,8 @@ +2012-04-20 Eli Zaretskii + + * dispnew.c (swap_glyph_pointers, copy_row_except_pointers): Don't + overrun array limits of glyph row's used[] array. (Bug#11288) + 2012-04-20 Chong Yidong * process.c (wait_reading_process_output): If EIO occurs on a pty, === modified file 'src/dispnew.c' --- src/dispnew.c 2012-03-20 08:52:11 +0000 +++ src/dispnew.c 2012-04-20 14:04:13 +0000 @@ -1085,12 +1085,16 @@ swap_glyph_pointers (struct glyph_row *a for (i = 0; i < LAST_AREA + 1; ++i) { struct glyph *temp = a->glyphs[i]; - short used_tem = a->used[i]; a->glyphs[i] = b->glyphs[i]; b->glyphs[i] = temp; - a->used[i] = b->used[i]; - b->used[i] = used_tem; + if (i < LAST_AREA) + { + short used_tem = a->used[i]; + + a->used[i] = b->used[i]; + b->used[i] = used_tem; + } } a->hash = b->hash; b->hash = hash_tem; @@ -1105,7 +1109,7 @@ static inline void copy_row_except_pointers (struct glyph_row *to, struct glyph_row *from) { struct glyph *pointers[1 + LAST_AREA]; - short used[1 + LAST_AREA]; + short used[LAST_AREA]; unsigned hashval; /* Save glyph pointers of TO. */