GNU bug report logs - #58042
29.0.50; ASAN use-after-free in re_match_2_internal

Previous Next

Full log

Message #47 received at 58042 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Gerd Möllmann <gerd.moellmann <at> gmail.com>
Cc: 58042 <at> debbugs.gnu.org
Subject: Re: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal
Date: Tue, 04 Oct 2022 19:35:30 +0300

> From: Gerd Möllmann <gerd.moellmann <at> gmail.com>
> Date: Tue, 04 Oct 2022 16:33:45 +0200
> 
> 0x00011f90d0a1 is located 1953 bytes inside of 8184-byte region [0x00011f90c900,0x00011f90e8f8)
> freed by thread T0 here:
>     #0 0x103332de4 in wrap_free+0x98 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3ede4)
>     #1 0x100985df8 in rpl_free free.c:48
>     #2 0x1005b6e7c in lisp_free alloc.c:1038
>     #3 0x1005cba7c in compact_small_strings alloc.c:2191
>     #4 0x1005c9bfc in sweep_strings alloc.c:2072
>     #5 0x1005bcd00 in gc_sweep alloc.c:7397
>     #6 0x1005bae50 in garbage_collect alloc.c:6245
>     #7 0x1005ba36c in maybe_garbage_collect alloc.c:6090
>     #8 0x100650284 in maybe_gc lisp.h:5622
>     #9 0x100648cd4 in Ffuncall eval.c:2972
>     #10 0x10064b9a8 in internal_condition_case_n eval.c:1555
>     #11 0x1000cd964 in safe__call xdisp.c:3026
>     #12 0x1000cdc9c in safe__call1 xdisp.c:3062
>     #13 0x1001d60dc in prepare_menu_bars xdisp.c:13572
>     #14 0x1000f2018 in redisplay_internal xdisp.c:16523
>     #15 0x100108c0c in redisplay xdisp.c:16105
>     #16 0x10088fa44 in -[EmacsView layoutSublayersOfLayer:] nsterm.m:8662
>     #17 0x1900a9624 in CA::Layer::layout_if_needed(CA::Transaction*)+0x224 (QuartzCore:arm64e+0x20624)
>     #18 0x1901f661c in CA::Context::commit_transaction(CA::Transaction*, double, double*)+0x1c0 (QuartzCore:arm64e+0x16d61c)
>     #19 0x19008b4c8 in CA::Transaction::commit()+0x2bc (QuartzCore:arm64e+0x24c8)
>     #20 0x18bee1698 in __62+[CATransaction(NSCATransaction) NS_setFlushesWithDisplayLink]_block_invoke+0x12c (AppKit:arm64e+0x1ac698)
>     #21 0x18c646754 in ___NSRunLoopObserverCreateWithHandler_block_invoke+0x3c (AppKit:arm64e+0x911754)
>     #22 0x1892101a0 in __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__+0x20 (CoreFoundation:arm64e+0x841a0)
>     #23 0x18920fff0 in __CFRunLoopDoObservers+0x24c (CoreFoundation:arm64e+0x83ff0)
>     #24 0x18920f524 in __CFRunLoopRun+0x300 (CoreFoundation:arm64e+0x83524)
>     #25 0x18920ea80 in CFRunLoopRunSpecific+0x254 (CoreFoundation:arm64e+0x82a80)
>     #26 0x191e4e334 in RunCurrentEventLoopInMode+0x120 (HIToolbox:arm64e+0x32334)
>     #27 0x191e4dfc0 in ReceiveNextEventCommon+0x140 (HIToolbox:arm64e+0x31fc0)
>     #28 0x191e4de64 in _BlockUntilNextEventMatchingListInModeWithFilter+0x44 (HIToolbox:arm64e+0x31e64)
>     #29 0x18bd76518 in _DPSNextEvent+0x358 (AppKit:arm64e+0x41518)

Any idea how is the above related to the other two backtraces?  Why
don't I see 'main' at the top of the backtrace here?  Can the
sanitizer be asked to produce more than 30 backtrace frames?

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.