[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
asan report in rl_unix_filename_rubout
From: |
Grisha Levit |
Subject: |
asan report in rl_unix_filename_rubout |
Date: |
Mon, 6 Mar 2023 23:35:02 -0500 |
ASAN currently reports issues with rl_line_buffer in rl_unix_filename_rubout:
$ INPUTRC=<(echo '"X": unix-filename-rubout') ./bash --norc -in <<<.X
=================================================================
==13101==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x00010890247f at pc 0x000104a9e300 bp 0x00016b9172e0 sp
0x00016b9172d8
READ of size 1 at 0x00010890247f thread T0
#0 0x104a9e2fc in rl_unix_filename_rubout kill.c:387
diff --git a/lib/readline/kill.c b/lib/readline/kill.c
index 659e57fd..24011583 100644
--- a/lib/readline/kill.c
+++ b/lib/readline/kill.c
@@ -348,15 +348,15 @@ rl_unix_filename_rubout (int count, int key)
if (count <= 0)
count = 1;
- while (count--)
+ while (rl_point && count--)
{
c = rl_line_buffer[rl_point - 1];
/* First move backwards through whitespace */
while (rl_point && whitespace (c))
{
- rl_point--;
- c = rl_line_buffer[rl_point - 1];
+ if (--rl_point)
+ c = rl_line_buffer[rl_point - 1];
}
/* Consume one or more slashes. */
@@ -377,14 +377,14 @@ rl_unix_filename_rubout (int count, int key)
while (rl_point && (whitespace (c) || c == '/'))
{
- rl_point--;
- c = rl_line_buffer[rl_point - 1];
+ if (--rl_point)
+ c = rl_line_buffer[rl_point - 1];
}
while (rl_point && (whitespace (c) == 0) && c != '/')
{
- rl_point--; /* XXX - multibyte? */
- c = rl_line_buffer[rl_point - 1];
+ if (--rl_point) /* XXX - multibyte? */
+ c = rl_line_buffer[rl_point - 1];
}
}
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- asan report in rl_unix_filename_rubout,
Grisha Levit <=