Re: AddressSanitizer: heap-buffer-overflow lib/readline/bind.c:437 in rl_translate_keyseq

[Chet Ramey]

On 5/2/17 10:22 AM, Eduardo Bustamante wrote:

The valgrind issue might be related to the false positive issue from a
couple of weeks ago, but it really doesn't matter. The bash malloc
severely confuses valgrind.

> I think this is the fix:
> 
> dualbus@debian:~/src/gnu/bash$ git diff
> diff --git a/lib/readline/bind.c b/lib/readline/bind.c
> index 117f3427..e02750d6 100644
> --- a/lib/readline/bind.c
> +++ b/lib/readline/bind.c
> @@ -440,8 +440,10 @@ rl_translate_keyseq (const char *seq, char
> *array, int *len)
>         {
>           c = seq[++i];
> 
> -         if (c == 0)
> +         if (c == 0) {
> +           l++;
>             break;
> +         }
> 
>           /* Handle \C- and \M- prefixes. */
>           if ((c == 'C' || c == 'M') && seq[i + 1] == '-')
> 

This is on the right track, but still drops a trailing backslash. A
backslash ending the string should be preserved. That solves the
existing leak issue, avoids the problem with odd numbers of backslashes,
and is more consistent.

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    chet@case.edu    http://cnswww.cns.cwru.edu/~chet/