Hi Vim-7.4.712 (huge) accesses invalid memory with this command:
$ vim -u NONE \
-c ':e ++enc=utf8 ++bad=keep crash-3' \
-c ':call search(getline("."))|q'
... where crash-3 is the attached file (12 bytes).
Address sanitizer reports:
==7173== ERROR: AddressSanitizer: heap-buffer-overflow on address
0x606200016700 at pc 0x6dcf67 bp 0x7ffe04add270 sp 0x7ffe04add268
READ of size 1 at 0x606200016700 thread T0
#0 0x6dcf66 in regrepeat /home/pel/sb/vim/src/regexp.c:6119
#1 0x6d9488 in regmatch /home/pel/sb/vim/src/regexp.c:5235
#2 0x6d409b in regtry /home/pel/sb/vim/src/regexp.c:4099
#3 0x6d3cb5 in bt_regexec_both /home/pel/sb/vim/src/regexp.c:3988
#4 0x6d3347 in bt_regexec_multi /home/pel/sb/vim/src/regexp.c:3799
#5 0x7103be in vim_regexec_multi /home/pel/sb/vim/src/regexp.c:8275
#6 0x741ce9 in searchit /home/pel/sb/vim/src/search.c:639
#7 0x495686 in search_cmn /home/pel/sb/vim/src/eval.c:16361
#8 0x495f23 in f_search /home/pel/sb/vim/src/eval.c:16511
#9 0x479a22 in call_func /home/pel/sb/vim/src/eval.c:8760
#10 0x478aa2 in get_func_tv /home/pel/sb/vim/src/eval.c:8560
#11 0x4662f0 in ex_call /home/pel/sb/vim/src/eval.c:3505
#12 0x4f71f4 in do_one_cmd /home/pel/sb/vim/src/ex_docmd.c:2940
#13 0x4edfb8 in do_cmdline /home/pel/sb/vim/src/ex_docmd.c:1133
#14 0x4ecf7d in do_cmdline_cmd /home/pel/sb/vim/src/ex_docmd.c:738
#15 0x84cb31 in exe_commands /home/pel/sb/vim/src/main.c:2922
#16 0x846cc5 in main /home/pel/sb/vim/src/main.c:958
#17 0x7f289d92fec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
#18 0x405b18 in _start ??:?
0x606200016700 is located 0 bytes to the right of 4096-byte region
[0x606200015700,0x606200016700)
allocated by thread T0 here:
#0 0x7f289f40c41a in malloc ??:?
#1 0x604a07 in lalloc /home/pel/sb/vim/src/misc2.c:926
#2 0x6047c7 in alloc /home/pel/sb/vim/src/misc2.c:821
#3 0x8583a1 in mf_alloc_bhdr /home/pel/sb/vim/src/memfile.c:952
#4 0x8567b7 in mf_new /home/pel/sb/vim/src/memfile.c:392 (discriminator 1)
#5 0x5bab86 in ml_new_data /home/pel/sb/vim/src/memline.c:3545
#6 0x5abff5 in ml_open /home/pel/sb/vim/src/memline.c:408
#7 0x405d6e in open_buffer /home/pel/sb/vim/src/buffer.c:98
#8 0x4ca42e in do_ecmd /home/pel/sb/vim/src/ex_cmds.c:3710
#9 0x510878 in do_exedit /home/pel/sb/vim/src/ex_docmd.c:8495
(discriminator 7)
#10 0x50ffad in ex_edit /home/pel/sb/vim/src/ex_docmd.c:8391
#11 0x4f71f4 in do_one_cmd /home/pel/sb/vim/src/ex_docmd.c:2940
#12 0x4edfb8 in do_cmdline /home/pel/sb/vim/src/ex_docmd.c:1133
#13 0x4ecf7d in do_cmdline_cmd /home/pel/sb/vim/src/ex_docmd.c:738
#14 0x84cb31 in exe_commands /home/pel/sb/vim/src/main.c:2922
#15 0x846cc5 in main /home/pel/sb/vim/src/main.c:958
#16 0x7f289d92fec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
Shadow bytes around the buggy address:
0x0c0cbfffac90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0cbfffaca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0cbfffacb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0cbfffacc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0cbfffacd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c0cbffface0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0cbfffacf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0cbfffad00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0cbfffad10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0cbfffad20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0cbfffad30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap righ redzone: fb
Freed Heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
ASan internal: fe
==7173== ABORTING
Attached patch fixes it.
Bug was found using the "american fuzzy lop fuzzer":
http://lcamtuf.coredump.cx/afl/
Regards
Dominique
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
crash-3
Description: Binary data
diff -r 18d84ed365a5 src/regexp.c
--- a/src/regexp.c Wed Apr 22 22:18:22 2015 +0200
+++ b/src/regexp.c Tue Apr 28 21:38:17 2015 +0200
@@ -6113,7 +6113,7 @@
{
if (ireg_ic && enc_utf8)
cf = utf_fold(utf_ptr2char(opnd));
- while (count < maxcount)
+ while (count < maxcount && (*mb_ptr2len)(scan) >= len)
{
for (i = 0; i < len; ++i)
if (opnd[i] != scan[i])
