Buffer underflow in nano 2.4.2-1ubuntu0.1 causes SIGSEGV
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
nano (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
nusch@XPS13:~$ touch .the_test.swp
nusch@XPS13:~$ nano the_test
core dumped
LANG env is ="pl_PL.UTF" without it it doen't Segfault so error is connected with unicode handling.
Compiling nano from source(apt-get source - so the same version) doesn't geneate nano binary which beheaves same way.
The difference is in libncurses>w< library:
nusch@XPS13:~$ ldd /bin/nano
linux-vdso.so.1 => (0x00007ffe5cb0
libncursesw.so.5 => /lib/x86_
libtinfo.so.5 => /lib/x86_
libc.so.6 => /lib/x86_
libdl.so.2 => /lib/x86_
/lib64/
nusch@XPS13:~$ ldd /bin/nano_from_src
linux-vdso.so.1 => (0x00007ffd22d4
libncurses.so.5 => /lib/x86_
libtinfo.so.5 => /lib/x86_
libc.so.6 => /lib/x86_
libdl.so.2 => /lib/x86_
/lib64/
Backtrace of segfault:
Program received signal SIGSEGV, Segmentation fault.
(gdb) bt
#0 0x0000000000404047 in ?? ()
#1 0x00007ffff75d1a40 in __libc_start_main (main=0x403770, argc=2, argv=0x7fffffff
#2 0x0000000000404329 in ?? ()
Disassembly of that part of code:
40401d: 0f 84 3c 01 00 00 je 40415f <__sprintf_
404023: 83 7c 24 10 00 cmp DWORD PTR [rsp+0x10],0x0
404028: 75 0a jne 404034 <__sprintf_
40402a: 81 25 1c e8 22 00 ff and DWORD PTR [rip+0x22e81c]
404031: bf ff ff
404034: 48 8b 05 dd e7 22 00 mov rax,QWORD PTR [rip+0x22e7dd] # 632818 <stderr+0x1b8>
40403b: 48 8b 80 90 00 00 00 mov rax,QWORD PTR [rax+0x90]
404042: 48 85 c0 test rax,rax
404045: 74 0b je 404052 <__sprintf_
404047: 83 78 38 00 cmp DWORD PTR [rax+0x38],0x0
40404b: 7e 05 jle 404052 <__sprintf_
40404d: e8 3e fc 00 00 call 413c90 <__sprintf_
404052: 48 8b 7c 24 20 mov rdi,QWORD PTR [rsp+0x20]
404057: 48 85 ff test rdi,rdi
40405a: 0f 8e b5 00 00 00 jle 404115 <__sprintf_
404060: 48 8b 74 24 28 mov rsi,QWORD PTR [rsp+0x28]
ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: nano 2.4.2-1ubuntu0.1
ProcVersionSign
Uname: Linux 4.2.0-25-generic x86_64
NonfreeKernelMo
ApportVersion: 2.19.1-0ubuntu5
Architecture: amd64
CurrentDesktop: Unity
Date: Fri Jan 29 15:13:25 2016
InstallationDate: Installed on 2015-05-08 (266 days ago)
InstallationMedia: Ubuntu 15.04 "Vivid Vervet" - Release amd64 (20150422)
SourcePackage: nano
UpgradeStatus: Upgraded to wily on 2015-11-15 (74 days ago)
Changed in nano (Ubuntu): | |
status: | Incomplete → Fix Committed |
Changed in nano (Ubuntu): | |
status: | Fix Committed → Fix Released |
When I follow your recipe (touch .the_test.swp; nano the_test), I don't get a segfault but just an error message on the status bar:
[ Error reading lock file ./.the_test.swp: Not enough data read ]
Please try the command 'nano --ignore --locking the_test' instead (to test only the locking mechanism and exclude any other settings). And please paste the output of the command 'locale' -- because pl_PL.UTF does not look like the name of a locale to me.