[MacPorts] #51201: nano crashes when opening multiple files: use-after-free

MacPorts noreply at macports.org
Thu Apr 21 20:45:29 PDT 2016

#51201: nano crashes when opening multiple files: use-after-free
 Reporter:  jeremyhu@…  |      Owner:  jeremyhu@…
     Type:  defect      |     Status:  new
 Priority:  Normal      |  Milestone:
Component:  ports       |    Version:  2.3.4
 Keywords:              |       Port:  nano
 Using nano to open many files at once often causes the process to crash.

 Building with ASan reveals that this is a use-after-free.

 The issue seems to be that nano is feeing memory that it doesn't own, so
 the next time dirname(3) goes to use its buffer, nano crashes.

 Process:               nano [10512]
 Path:                  /opt/local/bin/nano
 Identifier:            nano
 Version:               0
 Code Type:             X86-64 (Native)
 Parent Process:        bash [4236]
 Responsible:           Terminal [601]
 User ID:               501

 Date/Time:             2016-04-21 20:33:52.998 -0700
 OS Version:            Mac OS X 10.11.5 (15F25)
 Report Version:        11
 Anonymous UUID:        1F70FDBA-936B-7CCF-17FE-84A1852F1452

 Sleep/Wake UUID:       28E1E682-A8AE-48E8-AEBC-1DCC31235440

 Time Awake Since Boot: 56000 seconds
 Time Since Wake:       700 seconds

 System Integrity Protection: enabled

 Crashed Thread:        0  Dispatch queue: com.apple.main-thread

 Exception Type:        EXC_CRASH (SIGABRT)
 Exception Codes:       0x0000000000000000, 0x0000000000000000

 Application Specific Information:
 ==10512==ERROR: AddressSanitizer: heap-use-after-free on address
 0x619000400180 at pc 0x00010fb1654a bp 0x7fff50317860 sp 0x7fff50317020
 WRITE of size 13 at 0x619000400180 thread T0
     #0 0x10fb16549 in wrap_memcpy
     #1 0x7fff9c576266 in dirname (libsystem_c.dylib+0x26266)
     #2 0x10f8faa62 in has_valid_path files.c:46
     #3 0x10f8fe51b in open_buffer files.c:452
     #4 0x10f934cdc in main nano.c:2574
     #5 0x7fff8acc05ac in start (libdyld.dylib+0x35ac)
     #6 0x26  (<unknown module>)

 0x619000400180 is located 0 bytes inside of 1024-byte region
 freed by thread T0 here:
     #0 0x10fb1e1c9 in wrap_free
     #1 0x10f8fac72 in has_valid_path files.c:62
     #2 0x10f8fe51b in open_buffer files.c:452
     #3 0x10f934cdc in main nano.c:2574
     #4 0x7fff8acc05ac in start (libdyld.dylib+0x35ac)
     #5 0x26  (<unknown module>)

 previously allocated by thread T0 here:
     #0 0x10fb1e000 in wrap_malloc
     #1 0x7fff9c576199 in dirname (libsystem_c.dylib+0x26199)
     #2 0x10f8faa62 in has_valid_path files.c:46
     #3 0x10f8fe51b in open_buffer files.c:452
     #4 0x10f934cdc in main nano.c:2574
     #5 0x7fff8acc05ac in start (libdyld.dylib+0x35ac)
     #6 0x26  (<unknown module>)

 SUMMARY: AddressSanitizer: heap-use-after-free
 (libclang_rt.asan_osx_dynamic.dylib+0x42549) in wrap_memcpy
 Shadow bytes around the buggy address:
   0x1c320007ffe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x1c320007fff0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x1c3200080000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x1c3200080010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x1c3200080020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 =>0x1c3200080030:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x1c3200080040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x1c3200080050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x1c3200080060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x1c3200080070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x1c3200080080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07
   Heap left redzone:       fa
   Heap right redzone:      fb
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack partial redzone:   f4
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb

 abort() called

 Global Trace Buffer (reverse chronological seconds):
 18446744068.605698 libclang_rt.asan_osx_dynamic.dylib   0x000000010fb34757
 Consult syslog for more information.
 18446744068.605705 libclang_rt.asan_osx_dynamic.dylib   0x000000010fb346de
 Address Sanitizer reported a failure.

 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
 0   libsystem_kernel.dylib              0x00007fff8d315f06 __pthread_kill
 + 10
 1   libsystem_pthread.dylib             0x00007fff86bfc4ec pthread_kill +
 90 (pthread.c:1249)
 2   libsystem_c.dylib                   0x00007fff9c5ae6e7 abort + 129
 3   libclang_rt.asan_osx_dynamic.dylib  0x000000010fb3e426
 __sanitizer::Abort() + 6
 4   libclang_rt.asan_osx_dynamic.dylib  0x000000010fb16577 wrap_memcpy +
 5   libsystem_c.dylib                   0x00007fff9c576267 dirname + 240
 6   nano                                0x000000010f8faa63 has_valid_path
 + 339 (files.c:46)
 7   nano                                0x000000010f8fe51c open_buffer +
 1068 (files.c:452)
 8   nano                                0x000000010f934cdd main + 14077
 9   libdyld.dylib                       0x00007fff8acc05ad start + 1

 Thread 0 crashed with X86 Thread State (64-bit):
   rax: 0x0000000000000000  rbx: 0x0000000000000006  rcx:
 0x00007fff503165c8  rdx: 0x0000000000000000
   rdi: 0x000000000000050f  rsi: 0x0000000000000006  rbp:
 0x00007fff503165f0  rsp: 0x00007fff503165c8
    r8: 0x000000010fff7c53   r9: 0x0000000000000012  r10:
 0x0000000008000000  r11: 0x0000000000000206
   r12: 0x000000010fb4c67e  r13: 0x00007fff50316fb0  r14:
 0x00007fff76102000  r15: 0x000000010fda60a0
   rip: 0x00007fff8d315f06  rfl: 0x0000000000000206  cr2:

 Logical CPU:     0
 Error Code:      0x02000148
 Trap Number:     133

 Binary Images:
        0x10f8e7000 -        0x10f9a0ff7 +nano (0)
 <E06CEF76-F178-3094-A470-9FC42817F9EB> /opt/local/bin/nano
        0x10f9e2000 -        0x10f9eaff3 +libintl.8.dylib (0) <923E20D2
 -F8BE-3A24-88D8-59834B8F7CA5> /opt/local/lib/libintl.8.dylib
        0x10f9f5000 -        0x10fa11fff +libz.1.dylib (0) <AC3687FA-
 B3A3-37F5-9152-EABA1C013A0C> /opt/local/lib/libz.1.dylib
        0x10fa1c000 -        0x10fa33ff7 +libmagic.1.dylib (0)
 <6FADBBE1-BB34-36BB-80CE-DAD234D17D89> /opt/local/lib/libmagic.1.dylib
        0x10fa3f000 -        0x10fa9efff +libncurses.6.dylib (0)
 <42688968-AAEA-3474-BD55-9652A6A286FD> /opt/local/lib/libncurses.6.dylib
        0x10fad4000 -        0x10fb62ff7
 +libclang_rt.asan_osx_dynamic.dylib (0)
        0x110840000 -        0x11094efff +libiconv.2.dylib (0) <6941818D-
 37C9-3B88-BCA6-6D1E04A65F91> /opt/local/lib/libiconv.2.dylib
     0x7fff628ec000 -     0x7fff6292325f  dyld (360.22) <A468D85E-
 D8D6-3461-8C99-49D3B9ACFC63> /usr/lib/dyld
     0x7fff86b5f000 -     0x7fff86b63fff  libcache.dylib (75)
 <9548AAE9-2AB7-3525-9ECE-A2A7C4688447> /usr/lib/system/libcache.dylib
     0x7fff86bf6000 -     0x7fff86bffff7  libsystem_pthread.dylib
 (138.10.4) <3DD1EF4C-1D1B-3ABF-8CC6-B3B1CEEE9559>
     0x7fff87f92000 -     0x7fff87f97ff7  libmacho.dylib (875.1) <318264FA-
 58F1-39D8-8285-1F6254EE410E> /usr/lib/system/libmacho.dylib
     0x7fff885fe000 -     0x7fff88601fff  libsystem_sandbox.dylib
 (460.50.4) <150A9D3D-F69E-32F7-8C7B-8E72CAAFF7E4>
     0x7fff8968c000 -     0x7fff89694fff  libcopyfile.dylib (127)
 <A48637BC-F3F2-34F2-BB68-4C65FD012832> /usr/lib/system/libcopyfile.dylib
     0x7fff8983e000 -     0x7fff89a4bfff  libicucore.A.dylib (551.51.3)
 <5BC80F94-C90D-3175-BD96-FF1DC222EC9C> /usr/lib/libicucore.A.dylib
     0x7fff8a879000 -     0x7fff8a8bfff7  libauto.dylib (186) <999E610F-
 41FC-32A3-ADCA-5EC049B65DFB> /usr/lib/libauto.dylib
     0x7fff8acbd000 -     0x7fff8acc0ffb  libdyld.dylib (360.22)
 <CC088C2A-D407-33E7-A6B6-B06E0D4AD999> /usr/lib/system/libdyld.dylib
     0x7fff8bc28000 -     0x7fff8bc28ff7  libkeymgr.dylib (28) <8371CE54
 -5FDD-3CE9-B3DF-E98C761B6FE0> /usr/lib/system/libkeymgr.dylib
     0x7fff8c80e000 -     0x7fff8c813ff3  libunwind.dylib (35.3)
 <F6EB48E5-4D12-359A-AB54-C937FBBE9043> /usr/lib/system/libunwind.dylib
     0x7fff8c814000 -     0x7fff8c816ff7  libsystem_configuration.dylib
 (802.40.13) <3DEB7DF9-6804-37E1-BC83-0166882FF0FF>
     0x7fff8d2ff000 -     0x7fff8d31dff7  libsystem_kernel.dylib
 (3248.50.21) <78E54D59-D2B0-3F54-9A4A-0A68D671F253>
     0x7fff8d8ce000 -     0x7fff8dd44fff  com.apple.CoreFoundation (6.9 -
 1258.1) <943A1383-DA6A-3DC0-ABCD-D9AEB3D0D34D>
     0x7fff8f4a8000 -     0x7fff8f4b3ff7  libcommonCrypto.dylib
 (60075.50.1) <93732261-34B4-3914-B7A2-90A81A182DBA>
     0x7fff8f7ef000 -     0x7fff8f7f7fff  libsystem_networkextension.dylib
 (385.40.36) <66095DC7-6539-38F2-95EE-458F15F6D014>
     0x7fff8f7f8000 -     0x7fff8f821ff7  libxpc.dylib (765.50.8)
 <54D1328E-054E-3DAA-89E2-375722F9D18F> /usr/lib/system/libxpc.dylib
     0x7fff8f822000 -     0x7fff8f839ff7  libsystem_coretls.dylib (83.40.5)
     0x7fff8f954000 -     0x7fff8f97dfff  libc++abi.dylib (125)
 <DCCC8177-3D09-35BC-9784-2A04FEC4C71B> /usr/lib/libc++abi.dylib
     0x7fff8fab4000 -     0x7fff8fac5ff7  libz.1.dylib (61.20.1) <B3EBB42F-
 48E3-3287-9F0D-308E04D407AC> /usr/lib/libz.1.dylib
     0x7fff903b1000 -     0x7fff903cdff7  libsystem_malloc.dylib (67.40.1)
     0x7fff9061d000 -     0x7fff90625fef  libsystem_platform.dylib
 (74.40.2) <29A905EF-6777-3C33-82B0-6C3A88C4BA15>
     0x7fff9068e000 -     0x7fff906bbfff  libdispatch.dylib (501.40.12)
 <C7499857-61A5-3D7D-A5EA-65DCC8C3DF92> /usr/lib/system/libdispatch.dylib
     0x7fff919db000 -     0x7fff919dbff7  libunc.dylib (29)
 <DDB1E947-C775-33B8-B461-63E5EB698F0E> /usr/lib/system/libunc.dylib
     0x7fff9209c000 -     0x7fff920a3ff7  libcompiler_rt.dylib (62)
     0x7fff92764000 -     0x7fff9278dfff  libsystem_info.dylib (477.50.4)
     0x7fff9278e000 -     0x7fff9278fffb  libSystem.B.dylib (1226.10.1)
 <C5D09FE1-CC70-383E-AC27-18602F2EDEC4> /usr/lib/libSystem.B.dylib
     0x7fff93717000 -     0x7fff93718fff  libDiagnosticMessagesClient.dylib
 (100) <4243B6B4-21E9-355B-9C5A-95A216233B96>
     0x7fff94209000 -     0x7fff9425cff7  libc++.1.dylib (120.1)
 <8FC3D139-8055-3498-9AC5-6467CB7F4D14> /usr/lib/libc++.1.dylib
     0x7fff94ebb000 -     0x7fff94ec3ffb  libsystem_dnssd.dylib (625.50.5)
     0x7fff95116000 -     0x7fff95127ff7  libsystem_trace.dylib (201.10.3)
     0x7fff958c9000 -     0x7fff95940feb  libcorecrypto.dylib (335.50.1)
 <B5C05FD7-A540-345A-87BF-8E41848A3C17> /usr/lib/system/libcorecrypto.dylib
     0x7fff95ec2000 -     0x7fff95ecbff3  libsystem_notify.dylib (150.40.1)
     0x7fff9608e000 -     0x7fff96090fff  libsystem_coreservices.dylib
 (19.2) <1B3F5AFC-FFCD-3ECB-8B9A-5538366FB20D>
     0x7fff96276000 -     0x7fff96277ffb  libremovefile.dylib (41)
 <552EF39E-14D7-363E-9059-4565AC2F894E> /usr/lib/system/libremovefile.dylib
     0x7fff969ec000 -     0x7fff96d4ef3f  libobjc.A.dylib (680)
 <7489D2D6-1EFD-3414-B18D-2AECCCC90286> /usr/lib/libobjc.A.dylib
     0x7fff98beb000 -     0x7fff98bedff7  libquarantine.dylib (80)
 <0F4169F0-0C84-3A25-B3AE-E47B3586D908> /usr/lib/system/libquarantine.dylib
     0x7fff995d6000 -     0x7fff995d6ff7  liblaunch.dylib (765.50.8)
 <834ED605-5114-3641-AA4D-ECF31B801C50> /usr/lib/system/liblaunch.dylib
     0x7fff9b0a4000 -     0x7fff9b10aff7  libsystem_network.dylib
 (583.50.1) <B52DAB73-92DC-3DA7-B9F4-B899D66445C1>
     0x7fff9b9e3000 -     0x7fff9ba12ffb  libsystem_m.dylib (3105)
 <08E1A4B2-6448-3DFE-A58C-ACC7335BE7E4> /usr/lib/system/libsystem_m.dylib
     0x7fff9bad1000 -     0x7fff9bae8ff7  libsystem_asl.dylib (323.50.1)
 <41F8E11F-1BD0-3F1D-BA3A-AA1577ED98A9> /usr/lib/system/libsystem_asl.dylib
     0x7fff9bfec000 -     0x7fff9bfedfff  libsystem_blocks.dylib (65)
     0x7fff9c52f000 -     0x7fff9c530fff  libsystem_secinit.dylib (20)
     0x7fff9c550000 -     0x7fff9c5ddfff  libsystem_c.dylib (1082.50.1)
 <B552D565-B798-3B9B-AE63-F623B42A5F01> /usr/lib/system/libsystem_c.dylib

 External Modification Summary:
   Calls made by other processes targeting this process:
     task_for_pid: 1
     thread_create: 0
     thread_set_state: 0
   Calls made by this process:
     task_for_pid: 0
     thread_create: 0
     thread_set_state: 0
   Calls made by all processes on this machine:
     task_for_pid: 31953
     thread_create: 0
     thread_set_state: 0

 VM Region Summary:
 ReadOnly portion of Libraries: Total=109.0M resident=0K(0%)
 Writable regions: Total=14.0T written=0K(0%) resident=0K(0%)
 swapped_out=0K(0%) unallocated=14.0T(100%)

                                   VIRTUAL   REGION
 REGION TYPE                          SIZE    COUNT (non-coalesced)
 ===========                       =======  =======
 Activity Tracing                    2048K        2
 Kernel Alloc Once                      4K        2
 MALLOC                                 4K        2
 Performance tool data                6.0T      171         not counted in
 TOTAL below
 Performance tool data (reserved)    14.0T       55         reserved VM
 address space (unallocated)
 STACK GUARD                         56.0M        2
 Stack                               8192K        2
 VM_ALLOCATE                            4K        2
 __DATA                              15.6M       60
 __LINKEDIT                          92.0M       10
 __TEXT                              17.0M       52
 __UNICODE                            552K        2
 shared memory                         12K        4
 ===========                       =======  =======
 TOTAL                              191.2M      129
 TOTAL, minus reserved VM space   16777202.0T      129

 Model: MacBookPro11,5, BootROM MBP114.0172.B09, 4 processors, Intel Core
 i7, 2.8 GHz, 16 GB, SMC 2.30f2
 Graphics: AMD Radeon R9 M370X, AMD Radeon R9 M370X, PCIe, 2048 MB
 Graphics: Intel Iris Pro, Intel Iris Pro, Built-In
 Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x802C,
 Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x802C,
 AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x152),
 Broadcom BCM43xx 1.0 (
 Bluetooth: Version 4.4.5f3 17904, 3 services, 27 devices, 1 incoming
 serial ports
 Network Service: Wi-Fi, AirPort, en0
 Serial ATA Device: APPLE SSD SM1024G, 1 TB
 USB Device: USB 3.0 Bus
 USB Device: Apple Internal Keyboard / Trackpad
 USB Device: Bluetooth USB Host Controller
 Thunderbolt Bus: MacBook Pro, Apple Inc., 27.1

Ticket URL: <https://trac.macports.org/ticket/51201>
MacPorts <https://www.macports.org/>
Ports system for OS X

More information about the macports-tickets mailing list