From: "Ami Fischman" <ami@fischman.org>
To: emacs-devel@gnu.org
Subject: PATCH: fix for memory corruption and eventual crash in print.c
Date: Sat, 5 Jul 2008 21:11:14 -0700 [thread overview]
Message-ID: <b5a678470807052111i6bb3b283q1c931d2529ed4e0a@mail.gmail.com> (raw)
[-- Attachment #1.1: Type: text/plain, Size: 1835 bytes --]
src/print.c:print_object() has this code:
1570 if (NILP (Vprint_circle) && NILP (Vprint_gensym))
[...]
1581 being_printed[print_depth] = obj;
[...]
1611 print_depth++;
1612
1613 /* See similar code in print_preprocess. */
1614 if (print_depth > PRINT_CIRCLE)
1615 error ("Apparently circular structure being printed");
Note that being_printed[print_depth] is assigned to /before/ print_depth is
checked for exceeding PRINT_CIRCLE (the declared size of being_printed).
Here's a snippet of elisp that exhibits the bug:
(let ((print-circle nil)
(i 0))
(require 'cl)
(setq x '(a b))
(while (< i 200)
(incf i)
(setq x `(,x)))
(prin1-to-string x))
This errors with "Apparently circular structure being printed". So far so
good. Now evaling:
(prin1-to-string "hello")
errors with "Lisp nesting exceeds `max-lisp-eval-depth`" even though it
should be an easy thing to print!
Groveling with gdb shows that Vprin1_to_string_buffer gets overwritten
during the deep prin1 because of the bug above and instead of pointing at
the " prin1" buffer it has a value that pp's as a long chain of "[[[[[["'s
and errors out before completing the pretty-print.
Moving the guard check on print_depth above the assignment (and changing >
to >= because it's now above the print_depth++) makes the first elisp
snippet innocuous - eval'ing it still errors out about the apparently
circular structure, but subsequent prin1-to-string's work just fine.
Patch attached.
FWIW, I discovered the bug because using emacs-jabber was making my emacs
sessions unstable (at some point random standard elisp functions would start
failing). It turned out that one of its variables (jabber-connections) has
a deeply-enough nested component that this bug is triggered if it is
prin1'd.
Cheers,
-a
[-- Attachment #1.2: Type: text/html, Size: 4204 bytes --]
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: prin1.patch --]
[-- Type: text/x-patch; name=prin1.patch, Size: 817 bytes --]
diff --git a/src/print.c b/src/print.c
index 8fac266..b9d2e12 100644
--- a/src/print.c
+++ b/src/print.c
@@ -1560,6 +1560,10 @@ print_object (obj, printcharfun, escapeflag)
QUIT;
+ /* See similar code in print_preprocess. */
+ if (print_depth >= PRINT_CIRCLE)
+ error ("Apparently circular structure being printed");
+
/* Detect circularities and truncate them. */
if (STRINGP (obj) || CONSP (obj) || VECTORP (obj)
|| COMPILEDP (obj) || CHAR_TABLE_P (obj) || SUB_CHAR_TABLE_P (obj)
@@ -1610,9 +1614,6 @@ print_object (obj, printcharfun, escapeflag)
print_depth++;
- /* See similar code in print_preprocess. */
- if (print_depth > PRINT_CIRCLE)
- error ("Apparently circular structure being printed");
#ifdef MAX_PRINT_CHARS
if (max_print && print_chars > max_print)
{
next reply other threads:[~2008-07-06 4:11 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-06 4:11 Ami Fischman [this message]
2008-07-06 7:45 ` PATCH: fix for memory corruption and eventual crash in print.c YAMAMOTO Mitsuharu
2008-07-06 13:51 ` Chong Yidong
2008-07-07 10:03 ` YAMAMOTO Mitsuharu
2008-07-07 13:56 ` Chong Yidong
2008-07-21 5:06 ` Chong Yidong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b5a678470807052111i6bb3b283q1c931d2529ed4e0a@mail.gmail.com \
--to=ami@fischman.org \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.