GNU bug report logs - #58042
29.0.50; ASAN use-after-free in re_match_2_internal

Previous Next

Full log

View this message in rfc822 format

From: Po Lu <luangruo <at> yahoo.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: gerd.moellmann <at> gmail.com, alan <at> idiocy.org, 58042 <at> debbugs.gnu.org
Subject: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal
Date: Wed, 05 Oct 2022 21:52:52 +0800

Eli Zaretskii <eliz <at> gnu.org> writes:

> We call maybe_quit in many places, basically anywhere where we have
> potentially long loops.  It isn't just Fmemq.  So if we want to
> prevent maybe_quit from indirectly calling arbitrary Lisp, we'd need
> to block_input inside probably_quit.  Which means
> process_pending_signals will not call the read-socket hook and will
> not gobble input.  That's bad, I think.
>
> And note that this is only problematic on macOS (AFAIU), because there
> the read-socket hook can trigger redisplay.

There are many different ways to trigger redisplay from the read-socket
hook in the Haiku port as well, and I haven't seen any problems there.

Besides, any call to automatic GC today can run arbitrary Lisp through
finalizer functions, and that includes redisplay.  So unless the
read_socket_hook does not cons at all, there is no way to prevent
probably_quit from running Lisp code.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.