From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: RFC on proposal fix [Re: Crash caused by insert-file-contents, both trunk (bzr 111532) and 24.2.92 affected] Date: Fri, 18 Jan 2013 21:34:26 +0200 Message-ID: <83pq125lq5.fsf@gnu.org> References: <50F52EC0.2030309@yandex.ru> <8338y2qsyi.fsf@gnu.org> <50F593E8.2030105@yandex.ru> <83vcay8g2n.fsf@gnu.org> <50F830F6.1070805@yandex.ru> <83pq137l6o.fsf@gnu.org> <50F83F08.1060709@yandex.ru> Reply-To: Eli Zaretskii NNTP-Posting-Host: plane.gmane.org X-Trace: ger.gmane.org 1358537667 12980 80.91.229.3 (18 Jan 2013 19:34:27 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Fri, 18 Jan 2013 19:34:27 +0000 (UTC) Cc: emacs-devel@gnu.org To: Dmitry Antipov Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Fri Jan 18 20:34:45 2013 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1TwHi5-00064Y-IG for ged-emacs-devel@m.gmane.org; Fri, 18 Jan 2013 20:34:41 +0100 Original-Received: from localhost ([::1]:57722 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TwHho-0002Yo-Ss for ged-emacs-devel@m.gmane.org; Fri, 18 Jan 2013 14:34:24 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:49796) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TwHhl-0002Yi-Q9 for emacs-devel@gnu.org; Fri, 18 Jan 2013 14:34:23 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TwHhj-0002ND-TB for emacs-devel@gnu.org; Fri, 18 Jan 2013 14:34:21 -0500 Original-Received: from mtaout20.012.net.il ([80.179.55.166]:63114) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TwHhj-0002M8-LD for emacs-devel@gnu.org; Fri, 18 Jan 2013 14:34:19 -0500 Original-Received: from conversion-daemon.a-mtaout20.012.net.il by a-mtaout20.012.net.il (HyperSendmail v2007.08) id <0MGU004006CVP800@a-mtaout20.012.net.il> for emacs-devel@gnu.org; Fri, 18 Jan 2013 21:34:17 +0200 (IST) Original-Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il (HyperSendmail v2007.08) with ESMTPA id <0MGU004CY6D5I850@a-mtaout20.012.net.il>; Fri, 18 Jan 2013 21:34:17 +0200 (IST) In-reply-to: <50F83F08.1060709@yandex.ru> X-012-Sender: halo1@inter.net.il X-detected-operating-system: by eggs.gnu.org: Solaris 10 X-Received-From: 80.179.55.166 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:156462 Archived-At: > Date: Thu, 17 Jan 2013 22:12:24 +0400 > From: Dmitry Antipov > Cc: emacs-devel@gnu.org > > On 01/17/2013 09:50 PM, Eli Zaretskii wrote: > > > Can you tell which problems you found in the original code that these > > changes are supposed to fix? > > 1) Original code do emacs_read to ((char *) BEG_ADDR + PT_BYTE - BEG_BYTE + offset > without adjusting gap size, z and zv; this (IIUC) fools make_gap and so > enlarge_buffer_text; we end up with the gap which is less than expected, > read_non_regular do emacs_read into the buffer beyond allocated buffer text, > which finally causes EFAULT from emacs_read or heap corruption. I'm not sure I see how the gap size fails to be updated. There's a call to make_gap just before read_non_regular is called. Or did you mean GAP_SIZE? If the latter, then the comments there explain why this is not done. > 2) Original code throws I/O error too early without decoding the data possibly > read before. When not-yet-decoded part of buffer text is displayed, redisplay > is likely to crash. But until GAP_SIZE and ZV are updated, the inserted text is not really part of the buffer, right? So what is the problem here?