[MacPorts] #51201: nano crashes when opening multiple files: use-after-free
MacPorts
noreply at macports.org
Thu Apr 21 20:45:29 PDT 2016
#51201: nano crashes when opening multiple files: use-after-free
------------------------+------------------------
Reporter: jeremyhu@… | Owner: jeremyhu@…
Type: defect | Status: new
Priority: Normal | Milestone:
Component: ports | Version: 2.3.4
Keywords: | Port: nano
------------------------+------------------------
Using nano to open many files at once often causes the process to crash.
Building with ASan reveals that this is a use-after-free.
The issue seems to be that nano is feeing memory that it doesn't own, so
the next time dirname(3) goes to use its buffer, nano crashes.
{{{
Process: nano [10512]
Path: /opt/local/bin/nano
Identifier: nano
Version: 0
Code Type: X86-64 (Native)
Parent Process: bash [4236]
Responsible: Terminal [601]
User ID: 501
Date/Time: 2016-04-21 20:33:52.998 -0700
OS Version: Mac OS X 10.11.5 (15F25)
Report Version: 11
Anonymous UUID: 1F70FDBA-936B-7CCF-17FE-84A1852F1452
Sleep/Wake UUID: 28E1E682-A8AE-48E8-AEBC-1DCC31235440
Time Awake Since Boot: 56000 seconds
Time Since Wake: 700 seconds
System Integrity Protection: enabled
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Application Specific Information:
=================================================================
==10512==ERROR: AddressSanitizer: heap-use-after-free on address
0x619000400180 at pc 0x00010fb1654a bp 0x7fff50317860 sp 0x7fff50317020
WRITE of size 13 at 0x619000400180 thread T0
#0 0x10fb16549 in wrap_memcpy
(libclang_rt.asan_osx_dynamic.dylib+0x42549)
#1 0x7fff9c576266 in dirname (libsystem_c.dylib+0x26266)
#2 0x10f8faa62 in has_valid_path files.c:46
#3 0x10f8fe51b in open_buffer files.c:452
#4 0x10f934cdc in main nano.c:2574
#5 0x7fff8acc05ac in start (libdyld.dylib+0x35ac)
#6 0x26 (<unknown module>)
0x619000400180 is located 0 bytes inside of 1024-byte region
[0x619000400180,0x619000400580)
freed by thread T0 here:
#0 0x10fb1e1c9 in wrap_free
(libclang_rt.asan_osx_dynamic.dylib+0x4a1c9)
#1 0x10f8fac72 in has_valid_path files.c:62
#2 0x10f8fe51b in open_buffer files.c:452
#3 0x10f934cdc in main nano.c:2574
#4 0x7fff8acc05ac in start (libdyld.dylib+0x35ac)
#5 0x26 (<unknown module>)
previously allocated by thread T0 here:
#0 0x10fb1e000 in wrap_malloc
(libclang_rt.asan_osx_dynamic.dylib+0x4a000)
#1 0x7fff9c576199 in dirname (libsystem_c.dylib+0x26199)
#2 0x10f8faa62 in has_valid_path files.c:46
#3 0x10f8fe51b in open_buffer files.c:452
#4 0x10f934cdc in main nano.c:2574
#5 0x7fff8acc05ac in start (libdyld.dylib+0x35ac)
#6 0x26 (<unknown module>)
SUMMARY: AddressSanitizer: heap-use-after-free
(libclang_rt.asan_osx_dynamic.dylib+0x42549) in wrap_memcpy
Shadow bytes around the buggy address:
0x1c320007ffe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c320007fff0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200080000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200080010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c3200080020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x1c3200080030:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200080040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200080050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200080060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200080070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200080080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==10512==ABORTING
abort() called
Global Trace Buffer (reverse chronological seconds):
18446744068.605698 libclang_rt.asan_osx_dynamic.dylib 0x000000010fb34757
Consult syslog for more information.
18446744068.605705 libclang_rt.asan_osx_dynamic.dylib 0x000000010fb346de
Address Sanitizer reported a failure.
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 libsystem_kernel.dylib 0x00007fff8d315f06 __pthread_kill
+ 10
1 libsystem_pthread.dylib 0x00007fff86bfc4ec pthread_kill +
90 (pthread.c:1249)
2 libsystem_c.dylib 0x00007fff9c5ae6e7 abort + 129
3 libclang_rt.asan_osx_dynamic.dylib 0x000000010fb3e426
__sanitizer::Abort() + 6
4 libclang_rt.asan_osx_dynamic.dylib 0x000000010fb16577 wrap_memcpy +
1623
5 libsystem_c.dylib 0x00007fff9c576267 dirname + 240
6 nano 0x000000010f8faa63 has_valid_path
+ 339 (files.c:46)
7 nano 0x000000010f8fe51c open_buffer +
1068 (files.c:452)
8 nano 0x000000010f934cdd main + 14077
(nano.c:2574)
9 libdyld.dylib 0x00007fff8acc05ad start + 1
Thread 0 crashed with X86 Thread State (64-bit):
rax: 0x0000000000000000 rbx: 0x0000000000000006 rcx:
0x00007fff503165c8 rdx: 0x0000000000000000
rdi: 0x000000000000050f rsi: 0x0000000000000006 rbp:
0x00007fff503165f0 rsp: 0x00007fff503165c8
r8: 0x000000010fff7c53 r9: 0x0000000000000012 r10:
0x0000000008000000 r11: 0x0000000000000206
r12: 0x000000010fb4c67e r13: 0x00007fff50316fb0 r14:
0x00007fff76102000 r15: 0x000000010fda60a0
rip: 0x00007fff8d315f06 rfl: 0x0000000000000206 cr2:
0x00007fff7a51e008
Logical CPU: 0
Error Code: 0x02000148
Trap Number: 133
Binary Images:
0x10f8e7000 - 0x10f9a0ff7 +nano (0)
<E06CEF76-F178-3094-A470-9FC42817F9EB> /opt/local/bin/nano
0x10f9e2000 - 0x10f9eaff3 +libintl.8.dylib (0) <923E20D2
-F8BE-3A24-88D8-59834B8F7CA5> /opt/local/lib/libintl.8.dylib
0x10f9f5000 - 0x10fa11fff +libz.1.dylib (0) <AC3687FA-
B3A3-37F5-9152-EABA1C013A0C> /opt/local/lib/libz.1.dylib
0x10fa1c000 - 0x10fa33ff7 +libmagic.1.dylib (0)
<6FADBBE1-BB34-36BB-80CE-DAD234D17D89> /opt/local/lib/libmagic.1.dylib
0x10fa3f000 - 0x10fa9efff +libncurses.6.dylib (0)
<42688968-AAEA-3474-BD55-9652A6A286FD> /opt/local/lib/libncurses.6.dylib
0x10fad4000 - 0x10fb62ff7
+libclang_rt.asan_osx_dynamic.dylib (0)
<2FD61E39-48A1-3B98-B3E1-D7C7C245A993>
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib
0x110840000 - 0x11094efff +libiconv.2.dylib (0) <6941818D-
37C9-3B88-BCA6-6D1E04A65F91> /opt/local/lib/libiconv.2.dylib
0x7fff628ec000 - 0x7fff6292325f dyld (360.22) <A468D85E-
D8D6-3461-8C99-49D3B9ACFC63> /usr/lib/dyld
0x7fff86b5f000 - 0x7fff86b63fff libcache.dylib (75)
<9548AAE9-2AB7-3525-9ECE-A2A7C4688447> /usr/lib/system/libcache.dylib
0x7fff86bf6000 - 0x7fff86bffff7 libsystem_pthread.dylib
(138.10.4) <3DD1EF4C-1D1B-3ABF-8CC6-B3B1CEEE9559>
/usr/lib/system/libsystem_pthread.dylib
0x7fff87f92000 - 0x7fff87f97ff7 libmacho.dylib (875.1) <318264FA-
58F1-39D8-8285-1F6254EE410E> /usr/lib/system/libmacho.dylib
0x7fff885fe000 - 0x7fff88601fff libsystem_sandbox.dylib
(460.50.4) <150A9D3D-F69E-32F7-8C7B-8E72CAAFF7E4>
/usr/lib/system/libsystem_sandbox.dylib
0x7fff8968c000 - 0x7fff89694fff libcopyfile.dylib (127)
<A48637BC-F3F2-34F2-BB68-4C65FD012832> /usr/lib/system/libcopyfile.dylib
0x7fff8983e000 - 0x7fff89a4bfff libicucore.A.dylib (551.51.3)
<5BC80F94-C90D-3175-BD96-FF1DC222EC9C> /usr/lib/libicucore.A.dylib
0x7fff8a879000 - 0x7fff8a8bfff7 libauto.dylib (186) <999E610F-
41FC-32A3-ADCA-5EC049B65DFB> /usr/lib/libauto.dylib
0x7fff8acbd000 - 0x7fff8acc0ffb libdyld.dylib (360.22)
<CC088C2A-D407-33E7-A6B6-B06E0D4AD999> /usr/lib/system/libdyld.dylib
0x7fff8bc28000 - 0x7fff8bc28ff7 libkeymgr.dylib (28) <8371CE54
-5FDD-3CE9-B3DF-E98C761B6FE0> /usr/lib/system/libkeymgr.dylib
0x7fff8c80e000 - 0x7fff8c813ff3 libunwind.dylib (35.3)
<F6EB48E5-4D12-359A-AB54-C937FBBE9043> /usr/lib/system/libunwind.dylib
0x7fff8c814000 - 0x7fff8c816ff7 libsystem_configuration.dylib
(802.40.13) <3DEB7DF9-6804-37E1-BC83-0166882FF0FF>
/usr/lib/system/libsystem_configuration.dylib
0x7fff8d2ff000 - 0x7fff8d31dff7 libsystem_kernel.dylib
(3248.50.21) <78E54D59-D2B0-3F54-9A4A-0A68D671F253>
/usr/lib/system/libsystem_kernel.dylib
0x7fff8d8ce000 - 0x7fff8dd44fff com.apple.CoreFoundation (6.9 -
1258.1) <943A1383-DA6A-3DC0-ABCD-D9AEB3D0D34D>
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x7fff8f4a8000 - 0x7fff8f4b3ff7 libcommonCrypto.dylib
(60075.50.1) <93732261-34B4-3914-B7A2-90A81A182DBA>
/usr/lib/system/libcommonCrypto.dylib
0x7fff8f7ef000 - 0x7fff8f7f7fff libsystem_networkextension.dylib
(385.40.36) <66095DC7-6539-38F2-95EE-458F15F6D014>
/usr/lib/system/libsystem_networkextension.dylib
0x7fff8f7f8000 - 0x7fff8f821ff7 libxpc.dylib (765.50.8)
<54D1328E-054E-3DAA-89E2-375722F9D18F> /usr/lib/system/libxpc.dylib
0x7fff8f822000 - 0x7fff8f839ff7 libsystem_coretls.dylib (83.40.5)
<C90DAE38-4082-381C-A185-2A6A8B677628>
/usr/lib/system/libsystem_coretls.dylib
0x7fff8f954000 - 0x7fff8f97dfff libc++abi.dylib (125)
<DCCC8177-3D09-35BC-9784-2A04FEC4C71B> /usr/lib/libc++abi.dylib
0x7fff8fab4000 - 0x7fff8fac5ff7 libz.1.dylib (61.20.1) <B3EBB42F-
48E3-3287-9F0D-308E04D407AC> /usr/lib/libz.1.dylib
0x7fff903b1000 - 0x7fff903cdff7 libsystem_malloc.dylib (67.40.1)
<5748E8B2-F81C-34C6-8B13-456213127678>
/usr/lib/system/libsystem_malloc.dylib
0x7fff9061d000 - 0x7fff90625fef libsystem_platform.dylib
(74.40.2) <29A905EF-6777-3C33-82B0-6C3A88C4BA15>
/usr/lib/system/libsystem_platform.dylib
0x7fff9068e000 - 0x7fff906bbfff libdispatch.dylib (501.40.12)
<C7499857-61A5-3D7D-A5EA-65DCC8C3DF92> /usr/lib/system/libdispatch.dylib
0x7fff919db000 - 0x7fff919dbff7 libunc.dylib (29)
<DDB1E947-C775-33B8-B461-63E5EB698F0E> /usr/lib/system/libunc.dylib
0x7fff9209c000 - 0x7fff920a3ff7 libcompiler_rt.dylib (62)
<A13ECF69-F59F-38AE-8609-7B731450FBCD>
/usr/lib/system/libcompiler_rt.dylib
0x7fff92764000 - 0x7fff9278dfff libsystem_info.dylib (477.50.4)
<FAA9226D-64DE-3769-A6D8-6CABA4B7FF4D>
/usr/lib/system/libsystem_info.dylib
0x7fff9278e000 - 0x7fff9278fffb libSystem.B.dylib (1226.10.1)
<C5D09FE1-CC70-383E-AC27-18602F2EDEC4> /usr/lib/libSystem.B.dylib
0x7fff93717000 - 0x7fff93718fff libDiagnosticMessagesClient.dylib
(100) <4243B6B4-21E9-355B-9C5A-95A216233B96>
/usr/lib/libDiagnosticMessagesClient.dylib
0x7fff94209000 - 0x7fff9425cff7 libc++.1.dylib (120.1)
<8FC3D139-8055-3498-9AC5-6467CB7F4D14> /usr/lib/libc++.1.dylib
0x7fff94ebb000 - 0x7fff94ec3ffb libsystem_dnssd.dylib (625.50.5)
<4D10E12B-59B5-386F-82DA-326F18028F0A>
/usr/lib/system/libsystem_dnssd.dylib
0x7fff95116000 - 0x7fff95127ff7 libsystem_trace.dylib (201.10.3)
<F00E92E4-DBDA-3749-B5B3-0C3FBBABA1CB>
/usr/lib/system/libsystem_trace.dylib
0x7fff958c9000 - 0x7fff95940feb libcorecrypto.dylib (335.50.1)
<B5C05FD7-A540-345A-87BF-8E41848A3C17> /usr/lib/system/libcorecrypto.dylib
0x7fff95ec2000 - 0x7fff95ecbff3 libsystem_notify.dylib (150.40.1)
<D48BDE34-0F7E-34CA-A0FF-C578E39987CC>
/usr/lib/system/libsystem_notify.dylib
0x7fff9608e000 - 0x7fff96090fff libsystem_coreservices.dylib
(19.2) <1B3F5AFC-FFCD-3ECB-8B9A-5538366FB20D>
/usr/lib/system/libsystem_coreservices.dylib
0x7fff96276000 - 0x7fff96277ffb libremovefile.dylib (41)
<552EF39E-14D7-363E-9059-4565AC2F894E> /usr/lib/system/libremovefile.dylib
0x7fff969ec000 - 0x7fff96d4ef3f libobjc.A.dylib (680)
<7489D2D6-1EFD-3414-B18D-2AECCCC90286> /usr/lib/libobjc.A.dylib
0x7fff98beb000 - 0x7fff98bedff7 libquarantine.dylib (80)
<0F4169F0-0C84-3A25-B3AE-E47B3586D908> /usr/lib/system/libquarantine.dylib
0x7fff995d6000 - 0x7fff995d6ff7 liblaunch.dylib (765.50.8)
<834ED605-5114-3641-AA4D-ECF31B801C50> /usr/lib/system/liblaunch.dylib
0x7fff9b0a4000 - 0x7fff9b10aff7 libsystem_network.dylib
(583.50.1) <B52DAB73-92DC-3DA7-B9F4-B899D66445C1>
/usr/lib/system/libsystem_network.dylib
0x7fff9b9e3000 - 0x7fff9ba12ffb libsystem_m.dylib (3105)
<08E1A4B2-6448-3DFE-A58C-ACC7335BE7E4> /usr/lib/system/libsystem_m.dylib
0x7fff9bad1000 - 0x7fff9bae8ff7 libsystem_asl.dylib (323.50.1)
<41F8E11F-1BD0-3F1D-BA3A-AA1577ED98A9> /usr/lib/system/libsystem_asl.dylib
0x7fff9bfec000 - 0x7fff9bfedfff libsystem_blocks.dylib (65)
<1244D9D5-F6AA-35BB-B307-86851C24B8E5>
/usr/lib/system/libsystem_blocks.dylib
0x7fff9c52f000 - 0x7fff9c530fff libsystem_secinit.dylib (20)
<32B1A8C6-DC84-3F4F-B8CE-9A52B47C3E6B>
/usr/lib/system/libsystem_secinit.dylib
0x7fff9c550000 - 0x7fff9c5ddfff libsystem_c.dylib (1082.50.1)
<B552D565-B798-3B9B-AE63-F623B42A5F01> /usr/lib/system/libsystem_c.dylib
External Modification Summary:
Calls made by other processes targeting this process:
task_for_pid: 1
thread_create: 0
thread_set_state: 0
Calls made by this process:
task_for_pid: 0
thread_create: 0
thread_set_state: 0
Calls made by all processes on this machine:
task_for_pid: 31953
thread_create: 0
thread_set_state: 0
VM Region Summary:
ReadOnly portion of Libraries: Total=109.0M resident=0K(0%)
swapped_out_or_unallocated=109.0M(100%)
Writable regions: Total=14.0T written=0K(0%) resident=0K(0%)
swapped_out=0K(0%) unallocated=14.0T(100%)
VIRTUAL REGION
REGION TYPE SIZE COUNT (non-coalesced)
=========== ======= =======
Activity Tracing 2048K 2
Kernel Alloc Once 4K 2
MALLOC 4K 2
Performance tool data 6.0T 171 not counted in
TOTAL below
Performance tool data (reserved) 14.0T 55 reserved VM
address space (unallocated)
STACK GUARD 56.0M 2
Stack 8192K 2
VM_ALLOCATE 4K 2
__DATA 15.6M 60
__LINKEDIT 92.0M 10
__TEXT 17.0M 52
__UNICODE 552K 2
shared memory 12K 4
=========== ======= =======
TOTAL 191.2M 129
TOTAL, minus reserved VM space 16777202.0T 129
Model: MacBookPro11,5, BootROM MBP114.0172.B09, 4 processors, Intel Core
i7, 2.8 GHz, 16 GB, SMC 2.30f2
Graphics: AMD Radeon R9 M370X, AMD Radeon R9 M370X, PCIe, 2048 MB
Graphics: Intel Iris Pro, Intel Iris Pro, Built-In
Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x802C,
0x31364B544631473634485A2D314736453120
Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x802C,
0x31364B544631473634485A2D314736453120
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x152),
Broadcom BCM43xx 1.0 (7.21.95.175.1a6)
Bluetooth: Version 4.4.5f3 17904, 3 services, 27 devices, 1 incoming
serial ports
Network Service: Wi-Fi, AirPort, en0
Serial ATA Device: APPLE SSD SM1024G, 1 TB
USB Device: USB 3.0 Bus
USB Device: Apple Internal Keyboard / Trackpad
USB Device: Bluetooth USB Host Controller
Thunderbolt Bus: MacBook Pro, Apple Inc., 27.1
}}}
--
Ticket URL: <https://trac.macports.org/ticket/51201>
MacPorts <https://www.macports.org/>
Ports system for OS X
More information about the macports-tickets
mailing list