dc: crash on colon : operator

dc: crash on colon : operator

[istvan bak]

can anyone see my previous email?

Re: [9front] dc: crash on colon : operator

[Stanley Lieber]

On November 17, 2020 3:50:29 PM EST, istvan bak <bdhpfl@gmail.com> wrote:
>can anyone see my previous email?

I see this one. what was in the previous mail?

sl

Re: [9front] dc: crash on colon : operator

[Stuart Morrow]

On 17/11/2020, Stanley Lieber <sl@stanleylieber.com> wrote:
> On November 17, 2020 3:50:29 PM EST, istvan bak <bdhpfl@gmail.com> wrote:
>>can anyone see my previous email?
>
> I see this one. what was in the previous mail?
>
> sl
>

He wrote:

Hello.

dc crashes because a Blk* sometimes ends up both in the freelist and
on the stack, and in the symbol table. It tries to free what had
already been freed.

To make it crash (each line is a separate input to dc):

1 sa 2 :a le d sa v :a
1 sa 2 :a le d sa :a
1 sa 2 :a le d sa c

This is one input:
- 1 :
1 2 3 - 1 :

@@ -707,15 +710,15 @@
                                p = sptr->val;
                                if(length(p)-PTRSZ < c*PTRSZ) {
                                        q = copy(p,(c+PTRSZ)*PTRSZ);
                                        release(p);
                                        p = q;
                                }
                        }
+                       sptr->val = p;
                        seekc(p,c*PTRSZ);
                        q = lookwd(p);
                        if(q!=0)
                                release(q);
                        s = pop();
                        EMPTY;
                        salterwd(p, s);
-                       sptr->val = p;


set sptr->val to a consistent value before EMTPY causes a jump. After
the if/else block, either sptr->val == p (old p, which is on the hfree
freelist), or sptr->val == 0. Both are bad.

Two unrelated stuff: dcgetwd() can return 0. all other uses check for
0 ptr; so should the below case. and there's a buffer overflow. I
haven't tried to crash these.

Full patch:

diff -r cbc842a5093b sys/src/cmd/dc.c
--- a/sys/src/cmd/dc.c  Sun Nov 08 14:21:14 2020 -0800
+++ b/sys/src/cmd/dc.c  Tue Nov 10 19:22:07 2020 +0100
@@ -638,8 +638,11 @@
                                p = sptr->val;
                                if(c >= ARRAYST) {
                                        rewind(p);
-                                       while(sfeof(p) == 0)
-                                               release(dcgetwd(p));
+                                       while(sfeof(p) == 0) {
+                                               q = dcgetwd(p);
+                                               if(q != 0)
+                                                       release(q);
+                                       }
                                }
                                release(p);
                        } else {
@@ -711,6 +714,7 @@
                                        p = q;
                                }
                        }
+                       sptr->val = p;
                        seekc(p,c*PTRSZ);
                        q = lookwd(p);
                        if(q!=0)
@@ -718,7 +722,6 @@
                        s = pop();
                        EMPTY;
                        salterwd(p, s);
-                       sptr->val = p;
                        continue;
                case ';':
                        p = pop();
@@ -1921,7 +1924,8 @@
                sl = line;
                *sl++ = c;
                while((c = readc()) != '\n')
-                       *sl++ = c;
+                       if(sl < line+100-1)
+                               *sl++ = c;
                *sl = 0;
                if((pid = fork()) == 0) {
                        execl("/bin/rc","rc","-c",line,nil);

------------- End Quote

In other news, I don't know if it is news, but the machine we all know
from acpi.gif has a cool history:
https://en.wikipedia.org/wiki/Useless_machine

Re: [9front] dc: crash on colon : operator

[ori]

Quoth istvan bak <bdhpfl@gmail.com>:
> can anyone see my previous email?
> 

Yeah -- Sorry, I got busy and forgot to take a look.
Thanks for pinging it.

Re: [9front] dc: crash on colon : operator

[istvan bak]

Stuart: was that visible in your inbox, or did you grab that from the
archive? ty for help.

ori:
> Yeah -- Sorry, I got busy and forgot to take a look.

No worries, take your time.

Re: [9front] dc: crash on colon : operator

[Stuart Morrow]

> Stuart: was that visible in your inbox

Yes

Re: [9front] dc: crash on colon : operator

[istvan bak]

thanks ori, much appreciated

Re: [9front] dc: crash on colon : operator

[ori]

Quoth istvan bak <bdhpfl@gmail.com>:

> Full patch:

Thanks, and sorry for the long delay -- I'm not too familiar
with the dc code, so it took a while to review.

Committed with a small tweak:
 

>  		while((c = readc()) != '\n')
> -			*sl++ = c;
> +			if(sl < line+100-1)
> +				*sl++ = c;
>  		*sl = 0;