From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Gerd =?UTF-8?Q?M=C3=B6llmann?= Newsgroups: gmane.emacs.bugs Subject: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal Date: Sat, 24 Sep 2022 16:17:20 +0200 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="22510"; mail-complaints-to="usenet@ciao.gmane.io" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/29.0.50 (darwin) To: 58042@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sat Sep 24 16:19:05 2022 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oc5zk-0005ga-O9 for geb-bug-gnu-emacs@m.gmane-mx.org; Sat, 24 Sep 2022 16:19:04 +0200 Original-Received: from localhost ([::1]:35740 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oc5zj-0005Er-JO for geb-bug-gnu-emacs@m.gmane-mx.org; Sat, 24 Sep 2022 10:19:03 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:36878) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oc5yl-0004k3-1W for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 10:18:08 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:45816) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oc5yk-0000WD-Fl for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 10:18:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1oc5yk-0001vg-Ad for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 10:18:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Gerd =?UTF-8?Q?M=C3=B6llmann?= Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sat, 24 Sep 2022 14:18:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 58042 X-GNU-PR-Package: emacs Original-Received: via spool by 58042-submit@debbugs.gnu.org id=B58042.16640290537363 (code B ref 58042); Sat, 24 Sep 2022 14:18:02 +0000 Original-Received: (at 58042) by debbugs.gnu.org; 24 Sep 2022 14:17:33 +0000 Original-Received: from localhost ([127.0.0.1]:44890 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oc5yH-0001uh-1Z for submit@debbugs.gnu.org; Sat, 24 Sep 2022 10:17:33 -0400 Original-Received: from mail-ej1-f54.google.com ([209.85.218.54]:44720) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oc5yE-0001uR-CW for 58042@debbugs.gnu.org; Sat, 24 Sep 2022 10:17:31 -0400 Original-Received: by mail-ej1-f54.google.com with SMTP id r18so5853632eja.11 for <58042@debbugs.gnu.org>; Sat, 24 Sep 2022 07:17:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:to:from:from:to:cc:subject:date; bh=5e9vkGhvPM87qr443hzo5wyokUWlpX6uKcRzvBDSsU4=; b=btzmFZGNq9GVZfdXXi5aR0sPytf4G7E4myAo8wgo6Sdw2O0A6lIL/ilA2QqQKVgv6u /vC3f8/GBTyr0zzqzZBnX/Os89JZQ98iZG3GYshZB2XH1esU7DvTLxyndX3A4SWy6ps5 I3taL6SAugJiu2LsJIwhCUB2T+aqswwz5HjEK4vaxPgQA991wG/A36KME4rl7xzXxFvB jQxhSwuen4U4aNELbYCiKOtWXqMUEJxcc6K+o7ltM3G82jJUYqwx6czRGYMkBqCsY8BL R6spkrCRzEGPIT/FP+AFngSzKvCWe3x22wSf9bvWMd3aUUQUMLNrmWsiYpzHLfsnGn6a S8kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:to:from:x-gm-message-state:from:to :cc:subject:date; bh=5e9vkGhvPM87qr443hzo5wyokUWlpX6uKcRzvBDSsU4=; b=A2ze8rDfze44AvHsb86TA05IVFkemIDfbOckhe6WD0M+Ns7PB0vlct0RK+RwKcQ3kq XnMCLsY1r2x52TpnWUJZRNPtslHXaL1XFPi8maqjE9bIh4j5Iqo6b40hInt6Ei8I4Hzi 5KnhjLEJXeBr19lh7dlrpE56DE125xcizGey+5p/nOw/gMnbqAXelTEeItpfiFEkZYvN Mpsxdgza1noMPBKFQvRWu5LM8DG8iECH3tifhbXGDM6IYhi059P+mMg3s9jt0D+FMKHs CGO1PR5IdHuUNE82zoiPwNVFUC0ahkHtQMpgGzf15J6BdWGBrfv2k/dOOS4QynIpwSs9 rOcA== X-Gm-Message-State: ACrzQf2f+c/VDmpIaU2mGe1gfgkPV99hOV/5hoNtMmG7D4LRvQMrYoxu goPHpHkSoU4uERp++o/aOvwIt4cQ328= X-Google-Smtp-Source: AMsMyM7NPwDCbMAz/BxZtJGD2POt3ajAdt327A58RDVf4vRP5y9Hl7Kk6nKFsSD9iJVGejSMeQkCpA== X-Received: by 2002:a17:906:7945:b0:73b:e605:f31 with SMTP id l5-20020a170906794500b0073be6050f31mr11125939ejo.129.1664029042768; Sat, 24 Sep 2022 07:17:22 -0700 (PDT) Original-Received: from Mini.fritz.box (p4fe3a935.dip0.t-ipconnect.de. [79.227.169.53]) by smtp.gmail.com with ESMTPSA id kz15-20020a17090777cf00b0073c82539183sm5457366ejc.91.2022.09.24.07.17.21 for <58042@debbugs.gnu.org> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 24 Sep 2022 07:17:21 -0700 (PDT) In-Reply-To: ("Gerd =?UTF-8?Q?M=C3=B6llmann?="'s message of "Sat, 24 Sep 2022 15:45:39 +0200") X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:243537 Archived-At: Gerd M=C3=B6llmann writes: > In GNU Emacs 29.0.50 (build 1, aarch64-apple-darwin21.6.0, NS > appkit-2113.60 Version 12.6 (Build 21G115)) of 2022-09-21 built on > Mini.fritz.box > Repository revision: 1231a601ebe1fd9fe454c504dbeb9267440242e7 > Repository branch: master > Windowing system distributor 'Apple', version 10.3.2113 > System Description: macOS 12.6 > > Configured using: > 'configure --cache-file /Users/gerd/tmp/config.cache.master > --with-native-compilation' >=20=20 > Configured features: > ACL DBUS GLIB GNUTLS JSON LCMS2 LIBXML2 MODULES NATIVE_COMP NOTIFY > KQUEUE NS PDUMPER PNG RSVG SQLITE3 THREADS TOOLKIT_SCROLL_BARS XIM ZLIB > > I got the following ASAN error today. Unfortunately, I don't have the > slightest idea how to reproduce this. > > =3D=3D79227=3D=3DERROR: AddressSanitizer: heap-use-after-free on address = 0x00011f81e7d1 at pc 0x0001005825c4 bp 0x00016fdcf370 sp 0x00016fdcf368 > READ of size 1 at 0x00011f81e7d1 thread T0 > #0 0x1005825c0 in re_match_2_internal regex-emacs.c:4352 > #1 0x10057e5cc in rpl_re_search_2 regex-emacs.c:3383 > #2 0x10057d1c4 in rpl_re_search regex-emacs.c:3177 > #3 0x10056115c in fast_string_match_internal search.c:492 > #4 0x1005045c0 in fast_string_match lisp.h:4818 > #5 0x100504018 in Ffind_file_name_handler fileio.c:324 > #6 0x1006dbe5c in openp lread.c:1911 > #7 0x1006d8844 in Fload lread.c:1302 > #8 0x1006e1af0 in save_match_data_load lread.c:1630 > #9 0x10064f8cc in load_with_autoload_queue eval.c:2269 > #10 0x10067d2f8 in Frequire fns.c:3274 Forget to copy the part where it is freed: freed by thread T0 here: #0 0x103332de4 in wrap_free+0x98 (libclang_rt.asan_osx_dynamic.dylib:ar= m64e+0x3ede4) #1 0x100985e38 in rpl_free free.c:48 #2 0x1005b71a4 in lisp_free alloc.c:1038 #3 0x1005cbda4 in compact_small_strings alloc.c:2191 #4 0x1005c9f24 in sweep_strings alloc.c:2072 #5 0x1005bd028 in gc_sweep alloc.c:7397 #6 0x1005bb178 in garbage_collect alloc.c:6245 #7 0x1005ba694 in maybe_garbage_collect alloc.c:6090 #8 0x1006505ac in maybe_gc lisp.h:5624 #9 0x100648ffc in Ffuncall eval.c:2972 #10 0x10064bcd0 in internal_condition_case_n eval.c:1555 #11 0x1000cdc8c in safe__call xdisp.c:3026 #12 0x1000cdfc4 in safe__call1 xdisp.c:3062 #13 0x1001d6404 in prepare_menu_bars xdisp.c:13572 #14 0x1000f2340 in redisplay_internal xdisp.c:16523 #15 0x100108f34 in redisplay xdisp.c:16105 #16 0x10088fa84 in -[EmacsView layoutSublayersOfLayer:] nsterm.m:8662 #17 0x1900a9624 in CA::Layer::layout_if_needed(CA::Transaction*)+0x224 = (QuartzCore:arm64e+0x20624) #18 0x1901f661c in CA::Context::commit_transaction(CA::Transaction*, do= uble, double*)+0x1c0 (QuartzCore:arm64e+0x16d61c) #19 0x19008b4c8 in CA::Transaction::commit()+0x2bc (QuartzCore:arm64e+0= x24c8) #20 0x18bee1698 in __62+[CATransaction(NSCATransaction) NS_setFlushesWi= thDisplayLink]_block_invoke+0x12c (AppKit:arm64e+0x1ac698) #21 0x18c646754 in ___NSRunLoopObserverCreateWithHandler_block_invoke+0= x3c (AppKit:arm64e+0x911754) #22 0x1892101a0 in __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_F= UNCTION__+0x20 (CoreFoundation:arm64e+0x841a0) #23 0x18920fff0 in __CFRunLoopDoObservers+0x24c (CoreFoundation:arm64e+= 0x83ff0) #24 0x18920f524 in __CFRunLoopRun+0x300 (CoreFoundation:arm64e+0x83524) #25 0x18920ea80 in CFRunLoopRunSpecific+0x254 (CoreFoundation:arm64e+0x= 82a80) #26 0x191e4e334 in RunCurrentEventLoopInMode+0x120 (HIToolbox:arm64e+0x= 32334) #27 0x191e4dfc0 in ReceiveNextEventCommon+0x140 (HIToolbox:arm64e+0x31f= c0) #28 0x191e4de64 in _BlockUntilNextEventMatchingListInModeWithFilter+0x4= 4 (HIToolbox:arm64e+0x31e64) #29 0x18bd76518 in _DPSNextEvent+0x358 (AppKit:arm64e+0x41518) > > previously allocated by thread T0 here: > #0 0x103332ca8 in wrap_malloc+0x94 (libclang_rt.asan_osx_dynamic.dyli= b:arm64e+0x3eca8) > #1 0x1005ae8fc in lmalloc alloc.c:1361 > #2 0x1005b0188 in lisp_malloc alloc.c:994 > #3 0x1005b0a5c in allocate_string_data alloc.c:1889 > #4 0x1005b1bd8 in make_clear_multibyte_string alloc.c:2475 > #5 0x1005b1670 in make_clear_string alloc.c:2443 > #6 0x1005b2714 in make_uninit_string alloc.c:2454 > #7 0x100666c14 in concat_to_string fns.c:821 > #8 0x100666420 in concat2 fns.c:600 > #9 0x1006d7870 in Fget_load_suffixes lread.c:1123 > #10 0x1006d86ac in Fload lread.c:1296 > #11 0x1006e1af0 in save_match_data_load lread.c:1630 > #12 0x10064f8cc in load_with_autoload_queue eval.c:2269 > > rame #5: 0x00000001005825c4 emacs`re_match_2_internal(bufp=3D0x0000000101= 11b890, string1=3D0x0000000000000000, size1=3D0, string2=3D"/Users/gerd/.co= nfig/emacs.d.default/elpa/company-0.9.13/lsp-protocol.el.gz", size2=3D74, p= os=3D0, regs=3D0x0000000000000000, stop=3D74) at regex-emacs.c:4352:18 > 4349=09 > 4350 PREFETCH (); > 4351 int len; > -> 4352 int corig =3D RE_STRING_CHAR_AND_LENGTH (d, len, target_mult= ibyte); > 4353 int c =3D corig; > 4354 if (target_multibyte) > 4355 { > > And to make things worse, I can't get an xbacktrace because the "new" > lldb, which I got with Xcode 14, says it has a bug. Tadah :-/. > > (lldb) xbacktrace > PLEASE submit a bug report to https://developer.apple.com/bug-reporting/ = and include the crash backtrace. > Stack dump: