Bug 279426 - ^R ^W can cause libedit to read before the start of a buffer
Summary: ^R ^W can cause libedit to read before the start of a buffer
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-31 09:31 UTC by Robert Morris
Modified: 2024-06-01 16:24 UTC (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2024-05-31 09:31:48 UTC 
If I run valgrind on /bin/sh or other programs that use libedit, and
type ^R ^W at the start of a line, valgrind complains:

  Invalid read of size 4
     at 0x4873B3B: c__next_word (rtm/freebsd/contrib/libedit/chared.c:266)
     by 0x4892E7D: ce_inc_search (rtm/freebsd/contrib/libedit/search.c:300)
     by 0x487C25B: em_inc_search_prev (rtm/freebsd/contrib/libedit/emacs.c:488)
     by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
     by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
     by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
     by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
     by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
     by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
     by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
     by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
     by 0x1295D2: main (rtm/freebsd/bin/sh/main.c:167)
   Address 0x553329c is 4 bytes before a block of size 4,096 alloc'd
     at 0x4851735: calloc (vg_replace_malloc.c:1599)
     by 0x48740AA: ch_init (rtm/freebsd/contrib/libedit/chared.c:399)
     by 0x4877714: el_init_internal (rtm/freebsd/contrib/libedit/el.c:107)
     by 0x48775B0: el_init_fd (rtm/freebsd/contrib/libedit/el.c:124)
     by 0x487754A: el_init (rtm/freebsd/contrib/libedit/el.c:66)
     by 0x1215BC: histedit (rtm/freebsd/bin/sh/histedit.c:183)
     by 0x12C1ED: optschanged (rtm/freebsd/bin/sh/options.c:130)
     by 0x12BEA1: procargs (rtm/freebsd/bin/sh/options.c:121)
     by 0x1293EC: main (rtm/freebsd/bin/sh/main.c:131)

Perhaps this can be fixed by adding this after line 297 of search.c:

  if(el->el_line.cursor == el->el_line.buffer)
    break;

FreeBSD stock14 15.0-CURRENT FreeBSD 15.0-CURRENT #22 main-n270479-ecd1d1f1dac4-dirty: Thu May 30 18:42:11 AST 2024     root@stock14:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64