bug-gnu-emacs
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#9874: Fixes for several integer overflow and width issues


From: Juanma Barranquero
Subject: bug#9874: Fixes for several integer overflow and width issues
Date: Wed, 26 Oct 2011 16:26:41 +0200

> Thank you very much, but we're too far in the release process for such
> large patches, so it will have to wait for 24.2.

These bugs seem serious enough:

    - On my Fedora 14 x86-64 host, (signal-process 4294967295 1)
      crashes my entire login session, Emacs included, and leaves my
      workstation in a corrupted state in which the screen
      continually flashes a nonsense pattern and I cannot log in.
      This bug occurs because Emacs incorrectly assumes that fixnums
      fit into pid_t values, which is not true on typical 64-bit hosts.

    - The following code makes Emacs dump core:

        (progn
          (setq code-conversion-map-vector 0)
          (register-code-conversion-map 'x (make-vector 1 1)))

    - (font-get-glyphs FONT-OBJECT FROM TO) goes beserk if TO - FROM
      exceeds 2**31, and if you're lucky it dumps core.

    - (modify-frame-parameters FRAME ALIST) can overrun the C stack
      if ALIST is long.

    - The Lisp reader mishandles syntax errors like '(#^^[]), causing
      it to read storage that is out of bounds of an array.  It also
      mishandles '(#^^[4294967297 ...]), causing it to treat the
      large integer as if it were 1.

    - insert-file-contents overly trusts the inserted-char counts
      returned by the hooks; they should be sanity checked, to avoid
      the potential for calculating incorrect buffer offsets.

    - concat mishandles some long strings.  It checks for byte count
      overflow in places where it should check for char count overflow,
      and it misses some byte count overflows.

    - (find-operation-coding-system 'write-region 1 2) has an
      off-by-one error that causes it to access the garbage that
      is one past its argument array.

 * Callers to larger_vector often blindly multiply sizes by 2, which
   can lead to integer overflow with large sizes.  Change
   larger_vector's API to make it easier check for size overflow when
   growing a vector.




reply via email to

[Prev in Thread] Current Thread [Next in Thread]