Subject: bug#53333: closed (Re: bug#53333: Fix for crash in ebrowse)

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 20 Jan 2022 11:47:02 +0000

Your bug report

#53333: Fix for crash in ebrowse

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
53333: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=53333
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#53333: Fix for crash in ebrowse
From: Eli Zaretskii <[email-masked]>
To: Jan Stranik <[email-masked]>
Cc: [email-masked]
Date: Thu, 20 Jan 2022 13:45:31 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

> From: Jan Stranik <[email-masked]>
> Cc: [email-masked]
> Date: Tue, 18 Jan 2022 20:32:55 -0500
> 
> >
> > Thanks, but can you explain the need for this part:
> >
> >> !           else {
> >> !               s++;
> >> !               break;
> >> !           }
> >> !       }
> >
> > Why do we need to advance the pointer 's' in the 'else' clause? why
> > not leave it alone?
> 
> The identifier is copied from end to the buffer. As we are copying, we
> want to escape quote and backslash characters. Normally if we encounter
> any of these characters we just prepend \ to in front. If there is not
> enough space in the buffer to insert the \, we should increase the s, to
> back-out the character that we wanted to escape.
> 
> If we would not do that, the first character might not be escaped. If
> that character were a quote, it would break the lisp expressions written
> later to the BROWSE file.

Thanks, I installed the change on the emacs-28 branch, and I'm marking
this bug done.

Subject: Fix for crash in ebrowse
From: Jan Stranik <[email-masked]>
To: [email-masked]
Date: Mon, 17 Jan 2022 17:35:36 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello --

attached is a patch to ebrowse. Noticed a one-off write error in case of
identifiers that are too long and need escaping. The patch prevents the
write to memory outside of allocated range which on my platform caused
segfault.

Best,

Dont crash on C source code (one off error)

The fix avoids one off error in case the last character in the buffer
needs to be escaped but there is not enough space in buffer to perform
the escape.

The change just simiply ignores the character in such case.

Author: Jan Stranik <[email-masked]>

*** /var/home/janstranik/src/emacs-27.2/lib-src/ebrowse.c~	2021-01-28 11:52:16.000000000 -0600
--- /var/home/janstranik/src/emacs-27.2/lib-src/ebrowse.c	2021-09-24 09:31:49.136287028 -0500
***************
*** 1924,1931 ****
      {
        *--s = *--t;
  
!       if (*s == '"' || *s == '\\')
!         *--s = '\\';
      }
  
    *(matching_regexp_end_buf - 1) = '\0';
--- 1924,1937 ----
      {
        *--s = *--t;
  
!       if (*s == '"' || *s == '\\') {
!           if (s > matching_regexp_buffer)
!               *--s = '\\';
!           else {
!               s++;
!               break;
!           }
!       }
      }
  
    *(matching_regexp_end_buf - 1) = '\0';

-- 

Jan Stranik