From unknown Fri Jun 20 07:13:14 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#35576 <35576@debbugs.gnu.org> To: bug#35576 <35576@debbugs.gnu.org> Subject: Status: 27.0.50; Emacs crash when reads an integer with radix > 36 Reply-To: bug#35576 <35576@debbugs.gnu.org> Date: Fri, 20 Jun 2025 14:13:14 +0000 retitle 35576 27.0.50; Emacs crash when reads an integer with radix > 36 reassign 35576 emacs submitter 35576 Tino Calancha severity 35576 normal thanks From debbugs-submit-bounces@debbugs.gnu.org Sun May 05 07:37:26 2019 Received: (at submit) by debbugs.gnu.org; 5 May 2019 11:37:26 +0000 Received: from localhost ([127.0.0.1]:53129 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hNFSQ-0007mO-96 for submit@debbugs.gnu.org; Sun, 05 May 2019 07:37:26 -0400 Received: from eggs.gnu.org ([209.51.188.92]:44927) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hNFSO-0007m0-Ks for submit@debbugs.gnu.org; Sun, 05 May 2019 07:37:24 -0400 Received: from lists.gnu.org ([209.51.188.17]:37402) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hNFSJ-0005nx-BF for submit@debbugs.gnu.org; Sun, 05 May 2019 07:37:19 -0400 Received: from eggs.gnu.org ([209.51.188.92]:59305) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hNFSI-0005wA-An for bug-gnu-emacs@gnu.org; Sun, 05 May 2019 07:37:19 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_05,FREEMAIL_FROM, URIBL_BLOCKED autolearn=disabled version=3.3.2 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hNFSG-0005mT-LT for bug-gnu-emacs@gnu.org; Sun, 05 May 2019 07:37:18 -0400 Received: from mail-wr1-x430.google.com ([2a00:1450:4864:20::430]:42306) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hNFSG-0005lh-F3 for bug-gnu-emacs@gnu.org; Sun, 05 May 2019 07:37:16 -0400 Received: by mail-wr1-x430.google.com with SMTP id l2so13568531wrb.9 for ; Sun, 05 May 2019 04:37:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:mime-version; bh=NwgJDmFr2G9PLVAnU3FnmvbV1qoE/i2S/C+9wuYsEHU=; b=YdBbuxars3MsfSelJCgPael8lGpACJIpd6jpx6Djgm2bvH+m3qUmBMXHEzQYL/cNRB tMPsMi5PxYJxGmK3oP92SbwaYevYhiF87FQW/TQu2jsDADiB3+Xl6HJRBE4zLHv8cH2e +kYRxl/2xhaiKw8KHw59qlVJ5h/xtZSX88KzUlywGKUBtS7Fn3MJD2DgIdBMRfBZ37qJ 3O4dgUK9nffuQm8hlX160lSpN3CqalIQrev3UUnpTKGUqSMrlmuUyKK0YTlKyGlk5f7W EXl19XIFewJkk1vz3X+oVhFn0/3tjyFPgDsIg0rNzZKlCntpLcJ19NXm7F72D0QsZyBd TNdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:mime-version; bh=NwgJDmFr2G9PLVAnU3FnmvbV1qoE/i2S/C+9wuYsEHU=; b=H2HnyKQ7BWoDRbl77V5oG64irtqtlaWVddspLazxp9JKuniFNr85A3Nwypw/nwWKK4 vwa1JfCUsYa79xbsk09mkm7Ef5ZvphSaEmSNO7I2Z+uYeJVAZJu5cjUrwLdQ09gYfGH1 hpeuIBSPZNOGXboMcG9+Pe2fQOQwnRHESOXRBgNDUis/anYtcwXYm0qZsnhGx0b30soL v1fcHOzzkuuzY5GgfBopFH7xhOBSlkIQ6Z4yjO19EZ8Mvax5mI7KEKBIH/Gbz7i/0Y35 TsOtA0YpIXOxXCjloHKPh5lRSjbkxDDYmlgeFiFo37k9XPnfwqj274jsFUEvrY1sL17K C1og== X-Gm-Message-State: APjAAAVaBY8MWJUavJ3jScSDwiTwf8GSNdXMFDPvvTv40/xRe7oJlu3G RaYu7jeiwfN103Ga1ZJAm8d3OV7xaAA= X-Google-Smtp-Source: APXvYqzbac4GrFuFf4/6MS4bUmYctx2fuTH8jFiVejyRpTZSLmaErfOy0PW5HwVE1bk+nBaS6Pof0A== X-Received: by 2002:a5d:4403:: with SMTP id z3mr14850183wrq.186.1557056234326; Sun, 05 May 2019 04:37:14 -0700 (PDT) Received: from calancha-pc.dy.bbexcite.jp ([2a02:8308:703c:300:a925:e08:4b0c:f265]) by smtp.gmail.com with ESMTPSA id o16sm9522084wro.63.2019.05.05.04.37.12 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sun, 05 May 2019 04:37:13 -0700 (PDT) From: Tino Calancha To: bug-gnu-emacs@gnu.org Subject: 27.0.50; Emacs crash when reads an integer with radix > 36 Date: Sun, 05 May 2019 20:37:08 +0900 Message-ID: <87d0kxw2sb.fsf@calancha-pc.dy.bbexcite.jp> MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4864:20::430 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Spam-Score: -1.3 (-) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.3 (--) emacs -Q: ;; Emacs crash when you eval the following form M-: #37r1 ;; Expected: you get the error: ;; Invalid read syntax: "integer, radix 37" In GNU Emacs 27.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.22.11) of 2019-05-05 Windowing system distributor 'The X.Org Foundation', version 11.0.11902000 System Description: Debian GNU/Linux 9 (stretch) --8<-----------------------------cut here---------------start------------->8--- commit c5ffba787a10f80d17a0ebc7fc7e1fb0f754843d Author: Tino Calancha Date: Sun May 5 20:24:03 2019 +0900 src/lread.c (read_integer): Prevent from accessing a null buffer diff --git a/src/lread.c b/src/lread.c index 1c97805ca7..810e24d614 100644 --- a/src/lread.c +++ b/src/lread.c @@ -2660,19 +2660,17 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix) Also, room for invalid syntax diagnostic. */ size_t len = max (1 + 1 + UINTMAX_WIDTH + 1, sizeof "integer, radix " + INT_STRLEN_BOUND (EMACS_INT)); - char *buf = NULL; + char *buf = xmalloc (len); char *p = buf; int valid = -1; /* 1 if valid, 0 if not, -1 if incomplete. */ ptrdiff_t count = SPECPDL_INDEX (); - if (radix < 2 || radix > 36) valid = 0; else { int c, digit; - buf = xmalloc (len); record_unwind_protect_ptr (free_contents, &buf); p = buf; @@ -2718,8 +2716,10 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix) if (valid != 1) { - sprintf (buf, "integer, radix %"pI"d", radix); - invalid_syntax (buf); + xfree (buf); + char str[len]; + sprintf (str, "integer, radix %"pI"d", radix); + invalid_syntax (str); } *p = '\0'; --8<-----------------------------cut here---------------end--------------->8--- From debbugs-submit-bounces@debbugs.gnu.org Sun May 05 10:08:16 2019 Received: (at 35576-done) by debbugs.gnu.org; 5 May 2019 14:08:16 +0000 Received: from localhost ([127.0.0.1]:54600 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hNHoN-0005So-Vu for submit@debbugs.gnu.org; Sun, 05 May 2019 10:08:16 -0400 Received: from eggs.gnu.org ([209.51.188.92]:44372) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hNHoL-0005Sb-Qo for 35576-done@debbugs.gnu.org; Sun, 05 May 2019 10:08:14 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:47678) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hNHoG-0005Cl-9F; Sun, 05 May 2019 10:08:08 -0400 Received: from [176.228.60.248] (port=2943 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1hNHoF-0002RJ-Hg; Sun, 05 May 2019 10:08:08 -0400 Date: Sun, 05 May 2019 17:07:47 +0300 Message-Id: <837eb5kn9o.fsf@gnu.org> From: Eli Zaretskii To: Tino Calancha In-reply-to: <87d0kxw2sb.fsf@calancha-pc.dy.bbexcite.jp> (message from Tino Calancha on Sun, 05 May 2019 20:37:08 +0900) Subject: Re: bug#35576: 27.0.50; Emacs crash when reads an integer with radix > 36 References: <87d0kxw2sb.fsf@calancha-pc.dy.bbexcite.jp> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35576-done Cc: 35576-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > From: Tino Calancha > Date: Sun, 05 May 2019 20:37:08 +0900 > > emacs -Q: > ;; Emacs crash when you eval the following form > M-: #37r1 > > ;; Expected: you get the error: > ;; Invalid read syntax: "integer, radix 37" > > > > In GNU Emacs 27.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.22.11) > of 2019-05-05 > Windowing system distributor 'The X.Org Foundation', version 11.0.11902000 > System Description: Debian GNU/Linux 9 (stretch) > > > --8<-----------------------------cut here---------------start------------->8--- > commit c5ffba787a10f80d17a0ebc7fc7e1fb0f754843d > Author: Tino Calancha > Date: Sun May 5 20:24:03 2019 +0900 > > src/lread.c (read_integer): Prevent from accessing a null buffer Thanks, I installed a slightly different fix (there's no need to call xfree, since record_unwind_protect_ptr already takes care of that). From unknown Fri Jun 20 07:13:14 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Mon, 03 Jun 2019 11:24:07 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator