From: Stuart Morrow <morrow.stuart@gmail.com>
To: 9front@9front.org
Subject: Re: [9front] dc: crash on colon : operator
Date: Tue, 17 Nov 2020 21:13:57 +0000 [thread overview]
Message-ID: <CABB-WO_6xfi+5bEmFXbnKuS5RDaMC6wpa=KyfOF1rG6dPB2oqA@mail.gmail.com> (raw)
In-Reply-To: <B45B9E96-B745-404D-A064-009791CE1B3D@stanleylieber.com>
On 17/11/2020, Stanley Lieber <sl@stanleylieber.com> wrote:
> On November 17, 2020 3:50:29 PM EST, istvan bak <bdhpfl@gmail.com> wrote:
>>can anyone see my previous email?
>
> I see this one. what was in the previous mail?
>
> sl
>
He wrote:
Hello.
dc crashes because a Blk* sometimes ends up both in the freelist and
on the stack, and in the symbol table. It tries to free what had
already been freed.
To make it crash (each line is a separate input to dc):
1 sa 2 :a le d sa v :a
1 sa 2 :a le d sa :a
1 sa 2 :a le d sa c
This is one input:
- 1 :
1 2 3 - 1 :
@@ -707,15 +710,15 @@
p = sptr->val;
if(length(p)-PTRSZ < c*PTRSZ) {
q = copy(p,(c+PTRSZ)*PTRSZ);
release(p);
p = q;
}
}
+ sptr->val = p;
seekc(p,c*PTRSZ);
q = lookwd(p);
if(q!=0)
release(q);
s = pop();
EMPTY;
salterwd(p, s);
- sptr->val = p;
set sptr->val to a consistent value before EMTPY causes a jump. After
the if/else block, either sptr->val == p (old p, which is on the hfree
freelist), or sptr->val == 0. Both are bad.
Two unrelated stuff: dcgetwd() can return 0. all other uses check for
0 ptr; so should the below case. and there's a buffer overflow. I
haven't tried to crash these.
Full patch:
diff -r cbc842a5093b sys/src/cmd/dc.c
--- a/sys/src/cmd/dc.c Sun Nov 08 14:21:14 2020 -0800
+++ b/sys/src/cmd/dc.c Tue Nov 10 19:22:07 2020 +0100
@@ -638,8 +638,11 @@
p = sptr->val;
if(c >= ARRAYST) {
rewind(p);
- while(sfeof(p) == 0)
- release(dcgetwd(p));
+ while(sfeof(p) == 0) {
+ q = dcgetwd(p);
+ if(q != 0)
+ release(q);
+ }
}
release(p);
} else {
@@ -711,6 +714,7 @@
p = q;
}
}
+ sptr->val = p;
seekc(p,c*PTRSZ);
q = lookwd(p);
if(q!=0)
@@ -718,7 +722,6 @@
s = pop();
EMPTY;
salterwd(p, s);
- sptr->val = p;
continue;
case ';':
p = pop();
@@ -1921,7 +1924,8 @@
sl = line;
*sl++ = c;
while((c = readc()) != '\n')
- *sl++ = c;
+ if(sl < line+100-1)
+ *sl++ = c;
*sl = 0;
if((pid = fork()) == 0) {
execl("/bin/rc","rc","-c",line,nil);
------------- End Quote
In other news, I don't know if it is news, but the machine we all know
from acpi.gif has a cool history:
https://en.wikipedia.org/wiki/Useless_machine
next prev parent reply other threads:[~2020-11-17 21:14 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-17 20:50 istvan bak
2020-11-17 21:04 ` [9front] " Stanley Lieber
2020-11-17 21:13 ` Stuart Morrow [this message]
2020-11-17 21:15 ` ori
2020-11-17 21:42 ` istvan bak
2020-11-17 21:51 ` Stuart Morrow
-- strict thread matches above, loose matches on Subject: below --
2020-11-10 20:28 istvan bak
2020-11-22 1:56 ` [9front] " ori
2020-11-22 16:29 ` istvan bak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CABB-WO_6xfi+5bEmFXbnKuS5RDaMC6wpa=KyfOF1rG6dPB2oqA@mail.gmail.com' \
--to=morrow.stuart@gmail.com \
--cc=9front@9front.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).