Bug 227861 - math/sc-im: segmentation fault upon :wq
Summary: math/sc-im: segmentation fault upon :wq
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Kurt Jaeger
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-04-29 21:36 UTC by John Smith
Modified: 2018-08-19 14:38 UTC (History)
2 users (show)

See Also:
pi: maintainer-feedback-


Attachments
sc-im-0.7.0.diff (3.07 KB, patch)
2018-08-03 08:22 UTC, Samy Mahmoudi
no flags Details | Diff
sc-im-0.7.0_1.diff (3.48 KB, patch)
2018-08-03 09:01 UTC, Samy Mahmoudi
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description John Smith 2018-04-29 21:36:56 UTC
STR:
1. synth install math/sc-im
2. scim ~/test/test.csv
3. :wq

Segmentation fault.
Comment 1 Samy Mahmoudi 2018-08-02 09:39:04 UTC
Hi John,

I have started to examine your problem. The crash seems to be related to p.we_wordv pointing to 0x0000000000000000 (file.c, line 205). The root cause may be the conversion of "inputline" from wide character string to multibyte string "name" (file.c, line 200).

I will try to confirm this and to solve your problem as soon as possible.
Comment 2 Samy Mahmoudi 2018-08-02 14:14:17 UTC
The conversion is done properly so the root cause may actually be the instruction right after the conversion:

file.c:202: del_range_chars(name, 0, 1 + force_rewrite);
Comment 3 Samy Mahmoudi 2018-08-03 08:22:31 UTC
Created attachment 195812 [details]
sc-im-0.7.0.diff
Comment 4 Samy Mahmoudi 2018-08-03 08:24:44 UTC
When issuing the command wq by typing :wq, the function del_range_chars operates on the string "wq" and makes it the empty string "".

Then, word expansion fails at the next instruction and returns WRDE_SYNTAX. This results in p.we_wordv pointing to 0x0000000000000000, so that attempting to evaluate p.we_wordv[0] (which has a NULL parent) causes a segmentation fault.

The previous patch file should solve your problem. I tried to follow the upstream coding style, although some lines could have been rewritten for less complexity and more verbosity. Besides checking the pointer p.we_wordv:

• I added a conditional structure to check on trailing spaces which prevents other segmentation faults

• I extended :wq to :wq {file}

• I updated the documentation

• I found another important bug: overwriting is not prevented when filename is given without extension. I will report that and/or submit a patch upstream later.  

Enjoy !
Comment 5 Samy Mahmoudi 2018-08-03 08:47:49 UTC
Comment on attachment 195812 [details]
sc-im-0.7.0.diff

Index: Makefile
===================================================================
--- Makefile	(révision 476282)
+++ Makefile	(copie de travail)
@@ -1,9 +1,10 @@
 # $FreeBSD$
 
-PORTNAME=	sc-im
-PORTVERSION=	0.7.0
+PORTNAME=		sc-im
+PORTVERSION=		0.7.0
 DISTVERSIONPREFIX=	v
-CATEGORIES=	math
+PORTREVISION=		1
+CATEGORIES=		math
 
 MAINTAINER=	bapt@FreeBSD.org
 COMMENT=	Ncurses spreadsheet program for terminal
Index: files/patch-cmds__command.c
===================================================================
--- files/patch-cmds__command.c	(nonexistent)
+++ files/patch-cmds__command.c	(copie de travail)
@@ -0,0 +1,11 @@
+--- cmds_command.c.orig	2018-08-03 06:04:39 UTC
++++ cmds_command.c
+@@ -826,7 +826,7 @@ void do_commandmode(struct block * sb) {
+             exec_cmd(line);
+ 
+         } else if ( inputline[0] == L'w' ) {
+-            if (savefile() == 0 && ! wcscmp(inputline, L"wq")) shall_quit = 1;
++            if (savefile() == 0 && ! wcsncmp(inputline, L"wq", 2)) shall_quit = 1;
+ 
+         } else if ( ! wcsncmp(inputline, L"file ", 5) ) {
+ 

Property changes on: files/patch-cmds__command.c
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Index: files/patch-doc
===================================================================
--- files/patch-doc	(nonexistent)
+++ files/patch-doc	(copie de travail)
@@ -0,0 +1,11 @@
+--- doc.orig	2018-08-03 06:09:42 UTC
++++ doc
+@@ -328,6 +328,8 @@ Commands for handling cell content:
+      :w {file}   Save the current spreadsheet as {file}.
+      :w! {file}  Save the current spreadsheet as {file}, forcing an overwrite
+                  if {file} already exists.
++     :wq         Save the current spreadsheet and quit SC-IM.
++     :wq {file}  Save the current spreadsheet as {file} and quit SC-IM.
+ 
+      :h          Show this help.
+      :help       Show this help.

Property changes on: files/patch-doc
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Index: files/patch-file.c
===================================================================
--- files/patch-file.c	(nonexistent)
+++ files/patch-file.c	(copie de travail)
@@ -0,0 +1,16 @@
+--- file.c.orig	2017-12-13 17:48:59 UTC
++++ file.c
+@@ -202,7 +202,12 @@ int savefile() {
+     del_range_chars(name, 0, 1 + force_rewrite);
+     wordexp(name, &p, 0);
+ 
+-    if (! force_rewrite && p.we_wordv[0] && file_exists(p.we_wordv[0])) {
++    if (wcslen(inputline) > 2 && (!p.we_wordv || !p.we_wordv[0])) {
++       sc_error("Trailing space(s)");
++       return -1;
++    }
++
++    if (! force_rewrite && p.we_wordv && p.we_wordv[0] && file_exists(p.we_wordv[0])) {
+         sc_error("File already exists. Use \"!\" to force rewrite.");
+         wordfree(&p);
+         return -1;

Property changes on: files/patch-file.c
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Comment 6 Samy Mahmoudi 2018-08-03 09:01:37 UTC
Created attachment 195813 [details]
sc-im-0.7.0_1.diff
Comment 7 Samy Mahmoudi 2018-08-19 14:05:35 UTC
Merge requested upstream:

https://github.com/andmarti1424/sc-im/pull/280
Comment 8 Kurt Jaeger freebsd_committer freebsd_triage 2018-08-19 14:38:22 UTC
Committed, thanks!
Comment 9 commit-hook freebsd_committer freebsd_triage 2018-08-19 14:38:29 UTC
A commit references this bug:

Author: pi
Date: Sun Aug 19 14:38:08 UTC 2018
New revision: 477579
URL: https://svnweb.freebsd.org/changeset/ports/477579

Log:
  math/sc-im: fix segmentation fault upon :wq

  - bug reported upstream as https://github.com/andmarti1424/sc-im/pull/280

  PR:		227861
  Submitted by:	Samy Mahmoudi <samy.mahmoudi@gmail.com>
  Approved by:	bapt (maintainer timeout)

Changes:
  head/math/sc-im/Makefile
  head/math/sc-im/files/
  head/math/sc-im/files/patch-cmds__command.c
  head/math/sc-im/files/patch-doc
  head/math/sc-im/files/patch-file.c