From: cinap_lenrek@felloff.net
To: 9front@9front.org
Subject: Re: [9front] werc memory over flow
Date: Sat, 12 Mar 2022 12:23:56 +0100 [thread overview]
Message-ID: <CDCBC180CF87AAF0F4BC5AC7D4F7791B@felloff.net> (raw)
In-Reply-To: <7AF3DDC08B1B97F5D456A1AEE44E9AD7@eigenstate.org>
it doesnt matter so much. it is a memory corruption.
> hdr 0a110c09 00002020 0020cabc 00206fa7 3e703c0a 69206548
the callerpc of the allocation being corrupted is 0x20cabc
(this is amd64, not 386)
acid: src(0x20cabc)
/sys/src/cmd/awk/run.c:1898
1893 char *buf;
1894 void *p;
1895 int mflag, num;
1896 int bufsz = recsize;
1897
>1898 if ((buf = (char *)malloc(bufsz)) == nil)
1899 FATAL("out of memory in gsub");
1900 mflag = 0; /* if mflag == 0, can replace empty string */
1901 num = 0;
1902 x = execute(a[3]); /* target string */
1903 c = t = getsval(x);
which is in gsub() function.
from the tail, we can see that it overwrote one single '\0'
byte past the buffer.
it would be much better to have a reproducer for this bug,
not a stacktrace. we already have all the information.
now i could stare at this code for a day or you give me
a reproducer and then we can fix gsub() and make sure
the bug is fixed.
--
cinap
next prev parent reply other threads:[~2022-03-12 11:31 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-11 6:24 william
2022-03-11 6:33 ` ori
2022-03-11 15:18 ` ori
2022-03-12 11:23 ` cinap_lenrek [this message]
2022-03-12 11:54 ` cinap_lenrek
2022-03-12 12:34 ` cinap_lenrek
2022-03-13 7:27 ` william
2022-03-13 21:16 ` cinap_lenrek
2022-03-12 13:27 ` Steve Simon
2022-03-12 14:38 ` Steffen Nurpmeso
2022-03-11 16:49 ` Nick Owens
2022-03-11 20:13 ` cinap_lenrek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CDCBC180CF87AAF0F4BC5AC7D4F7791B@felloff.net \
--to=cinap_lenrek@felloff.net \
--cc=9front@9front.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).