GNU bug report logs - #58042
29.0.50; ASAN use-after-free in re_match_2_internal

Previous Next

Package: emacs;

Reported by: Gerd Möllmann <gerd.moellmann <at> gmail.com>

Date: Sat, 24 Sep 2022 13:46:01 UTC

Severity: normal

Found in version 29.0.50

Fixed in version 29.1

Done: Gerd Möllmann <gerd.moellmann <at> gmail.com>

Bug is archived. No further changes may be made.

Full log

Message #92 received at 58042 <at> debbugs.gnu.org (full text, mbox):

From: Po Lu <luangruo <at> yahoo.com>
To: Gerd Möllmann <gerd.moellmann <at> gmail.com>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 58042 <at> debbugs.gnu.org,
 Alan Third <alan <at> idiocy.org>
Subject: Re: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal
Date: Wed, 05 Oct 2022 19:15:22 +0800

Gerd Möllmann <gerd.moellmann <at> gmail.com> writes:

> Can somone please help me understand how this works?
>
> Let's say we are in memq called for list L.  Fmemq uses FOR_EACH_TAIL,
> which can call maybe_quit, which executes arbitrary Lisp, which can
> modify L.  And probably similarly in another 100 places.
>
> I don't get it.

AFAIU if it is particularly dangerous to modify L there, then input
should be blocked around Fmemq.
This bug report was last modified 2 years and 73 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.