GNU bug report logs - #18140
[PATCH] macros.c: CHECK_VECTOR_OR_STRING invokes wrong_type_argument for Qnil instead of return 0

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Jan Chaloupka <jchaloup <at> redhat.com>
Subject: bug#18140: closed (Re: bug#18140: [PATCH] macros.c:
 CHECK_VECTOR_OR_STRING invokes wrong_type_argument for Qnil instead of
 return 0)
Date: Tue, 29 Jul 2014 08:11:02 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#18140: [PATCH] macros.c: CHECK_VECTOR_OR_STRING invokes wrong_type_argument for Qnil instead of return 0

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 18140 <at> debbugs.gnu.org.

-- 
18140: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=18140
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Andreas Schwab <schwab <at> suse.de>
To: Jan Chaloupka <jchaloup <at> redhat.com>
Cc: 18140-done <at> debbugs.gnu.org
Subject: Re: bug#18140: [PATCH] macros.c: CHECK_VECTOR_OR_STRING invokes
 wrong_type_argument for Qnil instead of return 0
Date: Tue, 29 Jul 2014 10:10:11 +0200

Fixed for emacs 24.4.  Thanks for the report.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab <at> suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."

[Message part 3 (message/rfc822, inline)]

From: Jan Chaloupka <jchaloup <at> redhat.com>
To: bug-gnu-emacs <at> gnu.org
Subject: [PATCH] macros.c: CHECK_VECTOR_OR_STRING invokes wrong_type_argument
 for Qnil instead of return 0
Date: Tue, 29 Jul 2014 07:01:58 +0200

In function Fstart_kbd_macro (macros.c), Vlast_kbd_macro of current_kboard is Qnil for the first invocation.
If NILP (append) is false, current_kboard->kbd_macro_ptr has random value (in our case 0x5353535353535353),
which after CHECK_VECTOR_OR_STRING failure (invocation of wrong_type_argument) results in garbage collecting.
During gc, marking of objects is processed and mark_kboards (keyboard.c) is invoked. Following for loop is fired:

for (p = kb->kbd_macro_buffer; p < kb->kbd_macro_ptr; p++)
                  mark_object (*p);

Since kb->kbd_macro_ptr is set to 0x5353535353535353, mark_object (*p) is trying to mark object on address
out of memory space (or memory that cannot be accessed). Thus resulting in SIGSEGV signal.

Solution is to check for Qnil before calling CHECK_VECTOR_OR_STRING and set len to 0 if Qnil occurs.

https://bugzilla.redhat.com/show_bug.cgi?id=1104012

Signed-off-by: Jan Chaloupka <jchaloup <at> redhat.com>
---
 src/macros.c |   18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/macros.c b/src/macros.c
index 4730a8b..219eb39 100644
--- a/src/macros.c
+++ b/src/macros.c
@@ -85,7 +85,23 @@ macro before appending to it.  */)
       bool cvt;
 
       /* Check the type of last-kbd-macro in case Lisp code changed it.  */
-      len = CHECK_VECTOR_OR_STRING (KVAR (current_kboard, Vlast_kbd_macro));
+      /* If Vlast_kbd_macro is Qnil, skip the check and set len to 0.
+       * Flength returns 0 for Qnil, CHECK_VECTOR_OR_STRING has to do the same.
+       * Otherwise CHECK_VECTOR_OR_STRING fails and results in garbage collecting,
+       * which results in (keyboard.c, mark_kboards(void))
+       *
+       * for (p = kb->kbd_macro_buffer; p < kb->kbd_macro_ptr; p++)
+       * 	  mark_object (*p);
+       *
+       * Here, kb->kbd_macro_ptr is not initialized and can contain address
+       * 0x5353535353535353, which results in SIGSEGV trying to access the address.
+       *
+       * https://bugzilla.redhat.com/show_bug.cgi?id=1104012
+       */
+      if (!NILP (KVAR (current_kboard, Vlast_kbd_macro) ))
+        len = CHECK_VECTOR_OR_STRING (KVAR (current_kboard, Vlast_kbd_macro));
+      else
+        len = 0;
 
       /* Copy last-kbd-macro into the buffer, in case the Lisp code
 	 has put another macro there.  */

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.