bug-readline
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

asan report in rl_unix_filename_rubout


From: Grisha Levit
Subject: asan report in rl_unix_filename_rubout
Date: Mon, 6 Mar 2023 23:35:02 -0500

ASAN currently reports issues with rl_line_buffer in rl_unix_filename_rubout:

$ INPUTRC=<(echo '"X": unix-filename-rubout') ./bash --norc -in <<<.X
=================================================================
==13101==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x00010890247f at pc 0x000104a9e300 bp 0x00016b9172e0 sp
0x00016b9172d8
READ of size 1 at 0x00010890247f thread T0
    #0 0x104a9e2fc in rl_unix_filename_rubout kill.c:387

diff --git a/lib/readline/kill.c b/lib/readline/kill.c
index 659e57fd..24011583 100644
--- a/lib/readline/kill.c
+++ b/lib/readline/kill.c
@@ -348,15 +348,15 @@ rl_unix_filename_rubout (int count, int key)
       if (count <= 0)
        count = 1;

-      while (count--)
+      while (rl_point && count--)
        {
          c = rl_line_buffer[rl_point - 1];

          /* First move backwards through whitespace */
          while (rl_point && whitespace (c))
            {
-             rl_point--;
-             c = rl_line_buffer[rl_point - 1];
+             if (--rl_point)
+                c = rl_line_buffer[rl_point - 1];
            }

          /* Consume one or more slashes. */
@@ -377,14 +377,14 @@ rl_unix_filename_rubout (int count, int key)

          while (rl_point && (whitespace (c) || c == '/'))
            {
-             rl_point--;
-             c = rl_line_buffer[rl_point - 1];
+             if (--rl_point)
+               c = rl_line_buffer[rl_point - 1];
            }

          while (rl_point && (whitespace (c) == 0) && c != '/')
            {
-             rl_point--;       /* XXX - multibyte? */
-             c = rl_line_buffer[rl_point - 1];
+             if (--rl_point)   /* XXX - multibyte? */
+               c = rl_line_buffer[rl_point - 1];
            }
        }



reply via email to

[Prev in Thread] Current Thread [Next in Thread]