[Bug 279487] ESC [ F can cause libedit to read/write before start of buffer

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279487

            Bug ID: 279487
           Summary: ESC [ F can cause libedit to read/write before start
                    of buffer
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

This code in contrib/libedit/common.c:

ed_move_to_end(EditLine *el, wint_t c __attribute__((__unused__)))
{
     ...;
                  el->el_line.cursor--;

causes el->el_line.cursor to point before the start of
el->el_line.buffer if the current line is empty. Then subsequent
commands that read or write via cursor use the wrong memory.

For example, if I run valgrind /bin/sh and type

  $ set -o vi

and then (on a new line)

  ESC [ F x

valgrind says

  Invalid read of size 2
     at 0x4854920: memcpy (vg_replace_strmem.c:1163)
     by 0x487312C: cv_yank (rtm/freebsd/contrib/libedit/chared.c:90)
     by 0x4873652: c_delafter (rtm/freebsd/contrib/libedit/chared.c:129)
     by 0x4875E67: ed_delete_next_char
(rtm/freebsd/contrib/libedit/common.c:178)
     by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
     by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
     by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
     by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
     by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
     by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
     by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
     by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
   Address 0x552549c is 4 bytes before a block of size 4,096 alloc'd
     at 0x4851735: calloc (vg_replace_malloc.c:1599)
     by 0x48740AA: ch_init (rtm/freebsd/contrib/libedit/chared.c:399)
     by 0x4877714: el_init_internal (rtm/freebsd/contrib/libedit/el.c:107)
     by 0x48775B0: el_init_fd (rtm/freebsd/contrib/libedit/el.c:124)
     by 0x487754A: el_init (rtm/freebsd/contrib/libedit/el.c:66)
     by 0x1215BC: histedit (rtm/freebsd/bin/sh/histedit.c:183)
     by 0x12C1ED: optschanged (rtm/freebsd/bin/sh/options.c:130)
     by 0x12BEA1: procargs (rtm/freebsd/bin/sh/options.c:121)
     by 0x1293EC: main (rtm/freebsd/bin/sh/main.c:131)

  Invalid write of size 4
     at 0x487368A: c_delafter (rtm/freebsd/contrib/libedit/chared.c:136)
     by 0x4875E67: ed_delete_next_char
(rtm/freebsd/contrib/libedit/common.c:178)
     by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
     by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
     by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
     by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
     by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
     by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
     by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
     by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
     by 0x1295D2: main (rtm/freebsd/bin/sh/main.c:167)

-- 
You are receiving this mail because:
You are the assignee for the bug.