dc: crash on colon : operator

dc: crash on colon : operator

[istvan bak]

Hello.

dc crashes because a Blk* sometimes ends up both in the freelist and
on the stack, and in the symbol table. It tries to free what had
already been freed.

To make it crash (each line is a separate input to dc):

1 sa 2 :a le d sa v :a
1 sa 2 :a le d sa :a
1 sa 2 :a le d sa c

This is one input:
- 1 :
1 2 3 - 1 :

@@ -707,15 +710,15 @@
 				p = sptr->val;
 				if(length(p)-PTRSZ < c*PTRSZ) {
 					q = copy(p,(c+PTRSZ)*PTRSZ);
 					release(p);
 					p = q;
 				}
 			}
+			sptr->val = p;
 			seekc(p,c*PTRSZ);
 			q = lookwd(p);
 			if(q!=0)
 				release(q);
 			s = pop();
 			EMPTY;
 			salterwd(p, s);
-			sptr->val = p;


set sptr->val to a consistent value before EMTPY causes a jump. After
the if/else block, either sptr->val == p (old p, which is on the hfree
freelist), or sptr->val == 0. Both are bad.

Two unrelated stuff: dcgetwd() can return 0. all other uses check for
0 ptr; so should the below case. and there's a buffer overflow. I
haven't tried to crash these.

Full patch:

diff -r cbc842a5093b sys/src/cmd/dc.c
--- a/sys/src/cmd/dc.c	Sun Nov 08 14:21:14 2020 -0800
+++ b/sys/src/cmd/dc.c	Tue Nov 10 19:22:07 2020 +0100
@@ -638,8 +638,11 @@
 				p = sptr->val;
 				if(c >= ARRAYST) {
 					rewind(p);
-					while(sfeof(p) == 0)
-						release(dcgetwd(p));
+					while(sfeof(p) == 0) {
+						q = dcgetwd(p);
+						if(q != 0)
+							release(q);
+					}
 				}
 				release(p);
 			} else {
@@ -711,6 +714,7 @@
 					p = q;
 				}
 			}
+			sptr->val = p;
 			seekc(p,c*PTRSZ);
 			q = lookwd(p);
 			if(q!=0)
@@ -718,7 +722,6 @@
 			s = pop();
 			EMPTY;
 			salterwd(p, s);
-			sptr->val = p;
 			continue;
 		case ';':
 			p = pop();
@@ -1921,7 +1924,8 @@
 		sl = line;
 		*sl++ = c;
 		while((c = readc()) != '\n')
-			*sl++ = c;
+			if(sl < line+100-1)
+				*sl++ = c;
 		*sl = 0;
 		if((pid = fork()) == 0) {
 			execl("/bin/rc","rc","-c",line,nil);

Re: [9front] dc: crash on colon : operator

[ori]

Quoth istvan bak <bdhpfl@gmail.com>:

> Full patch:

Thanks, and sorry for the long delay -- I'm not too familiar
with the dc code, so it took a while to review.

Committed with a small tweak:
 

>  		while((c = readc()) != '\n')
> -			*sl++ = c;
> +			if(sl < line+100-1)
> +				*sl++ = c;
>  		*sl = 0;

Re: [9front] dc: crash on colon : operator

[istvan bak]

thanks ori, much appreciated

dc: crash on colon : operator

[istvan bak]

can anyone see my previous email?