Re: Another undo list UAF

[Chet Ramey]

On 1/17/25 4:47 PM, Grisha Levit wrote:

I just tried a fresh build on macOS (15.2, arm64) and see the same result:

$ ./configure CFLAGS='-fsanitize=address'
$ make -j
$ HISTFILE= INPUTRC=/ ./bash --norc -in <<< $' \n\cP \cN\cP\cU\cX\cE\n\e<'

bash-5.3$
bash-5.3$
bash-5.3$
bash-5.3$
=================================================================
==41074==ERROR: AddressSanitizer: heap-use-after-free on address
0x60300000a828 at pc 0x00010084622c bp 0x00016f951db0 sp
0x00016f951da8
READ of size 4 at 0x60300000a828 thread T0
     #0 0x100846228 in rl_do_undo+0x174 
(/private/tmp/bld/bash:arm64+0x10039e228)
     #1 0x10084740c in rl_revert_line+0xa8
(/private/tmp/bld/bash:arm64+0x10039f40c)
     #2 0x1007ba1dc in readline_common_teardown+0xc4
(/private/tmp/bld/bash:arm64+0x1003121dc)
     #3 0x1007ba3d0 in readline_internal_teardown+0x138
(/private/tmp/bld/bash:arm64+0x1003123d0)

This is after `make asan'.

$ ./bash --version

GNU bash, version 5.3.0(13)-beta (aarch64-apple-darwin23.6.0)
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

$
$
$
$
$ exit
$ uname -a


The only difference is I'm running 15.1.1.

--
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    c...@case.edu    http://tiswww.cwru.edu/~chet/

bash(54349,0x202dbf840) malloc: nano zone abandoned due to inability to reserve vm space. jenna.local(1)$ PS1='$ ' HISTFILE= INPUTRC=/ ./bash --norc -in <<< $' \n\cP \cN\cP\cU\cX\cE\n\e<' bash(54358,0x202dbf840) malloc: nano zone abandoned due to inability to reserve vm space. Darwin jenna.local 24.1.0 Darwin Kernel Version 24.1.0: Thu Oct 10 21:05:23 PDT 2024; root:xnu-11215.41.3~2/RELEASE_ARM64_T6031 arm64

OpenPGP_signature.asc
Description: OpenPGP digital signature