Re: realloc: start and end chunk sizes differ - rl_extend_line_buffer in lib/readline/util.c

[Eduardo A . Bustamante López]

On Mon, Jan 07, 2019 at 01:30:46AM -0800, Eduardo A. Bustamante López wrote:
(...)
> I missed a spot, updated patch:
> 
> diff -ruN bash-5.0-rc1.orig/lib/readline/undo.c 
> bash-5.0-rc1/lib/readline/undo.c
> --- bash-5.0-rc1.orig/lib/readline/undo.c       2019-01-03 13:14:43.428392927 
> -0800
> +++ bash-5.0-rc1/lib/readline/undo.c    2019-01-07 01:28:08.288255650 -0800
> @@ -196,6 +196,8 @@
>         /* Undoing deletes means inserting some text. */
>         case UNDO_DELETE:
>           rl_point = start;
> +         if (rl_point > rl_end)
> +           rl_point = rl_end;
>           rl_insert_text (rl_undo_list->text);
>           xfree (rl_undo_list->text);
>           break;
> @@ -204,6 +206,8 @@
>         case UNDO_INSERT:
>           rl_delete_text (start, end);
>           rl_point = start;
> +         if (rl_point > rl_end)
> +           rl_point = rl_end;
>           break;
>  
>         /* Undoing an END means undoing everything 'til we get to a BEGIN. */

Missed 2 actually, this is another case, in lib/readline/search.c now:

Hardware watchpoint 1: (rl_point > 0 && rl_point > rl_end + 1)

Old value = 0
New value = 1
_rl_nsearch_abort (cxt=0x5555557caf08) at 
../../../bash-5.0-rc1/lib/readline/search.c:258
258       rl_mark = cxt->save_mark;
(gdb) bt
#0  _rl_nsearch_abort (cxt=0x5555557caf08) at 
../../../bash-5.0-rc1/lib/readline/search.c:258
#1  0x000055555563fc73 in _rl_nsearch_dispatch (cxt=0x5555557caf08, c=3) at 
../../../bash-5.0-rc1/lib/readline/search.c:300
#2  0x000055555563fe2d in noninc_search (dir=1, pchar=0) at 
../../../bash-5.0-rc1/lib/readline/search.c:389
#3  0x000055555563fea9 in rl_noninc_forward_search (count=1, key=110) at 
../../../bash-5.0-rc1/lib/readline/search.c:405
#4  0x0000555555639ed4 in _rl_dispatch_subseq (key=110, map=0x5555556ac220 
<emacs_meta_keymap>, got_subseq=0) at 
../../../bash-5.0-rc1/lib/readline/readline.c:852
#5  0x000055555563a399 in _rl_dispatch_subseq (key=27, map=0x5555556ab200 
<emacs_standard_keymap>, got_subseq=0) at 
../../../bash-5.0-rc1/lib/readline/readline.c:986
#6  0x0000555555639c4b in _rl_dispatch (key=-135542668, map=0x5555556ab200 
<emacs_standard_keymap>) at ../../../bash-5.0-rc1/lib/readline/readline.c:798
#7  0x00005555556398ce in readline_internal_char () at 
../../../bash-5.0-rc1/lib/readline/readline.c:632
#8  0x0000555555639929 in readline_internal_charloop () at 
../../../bash-5.0-rc1/lib/readline/readline.c:659
#9  0x0000555555639949 in readline_internal () at 
../../../bash-5.0-rc1/lib/readline/readline.c:671
#10 0x0000555555639367 in readline (prompt=0x555555680f84 "") at 
../../../bash-5.0-rc1/lib/readline/readline.c:377
#11 0x0000555555611bcf in edit_line (p=0x555555680f84 "", itext=0x0) at 
../../bash-5.0-rc1/builtins/../../bash-5.0-rc1/builtins/read.def:1107
#12 0x00005555556108f8 in read_builtin (list=0x0) at 
../../bash-5.0-rc1/builtins/../../bash-5.0-rc1/builtins/read.def:566
#13 0x00005555555a5afa in execute_builtin (builtin=0x55555560fa73 
<read_builtin>, words=0x555555764cc8, flags=0, subshell=0) at 
../bash-5.0-rc1/execute_cmd.c:4706
#14 0x00005555555a6aa2 in execute_builtin_or_function (words=0x555555764cc8, 
builtin=0x55555560fa73 <read_builtin>, var=0x0, redirects=0x555555764b08, 
fds_to_close=0x555555764a28, flags=0)
    at ../bash-5.0-rc1/execute_cmd.c:5214
#15 0x00005555555a5365 in execute_simple_command 
(simple_command=0x555555764908, pipe_in=-1, pipe_out=-1, async=0, 
fds_to_close=0x555555764a28) at ../bash-5.0-rc1/execute_cmd.c:4476
#16 0x000055555559e9f4 in execute_command_internal (command=0x5555557648c8, 
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x555555764a28) at 
../bash-5.0-rc1/execute_cmd.c:842
#17 0x000055555560858a in parse_and_execute (string=0x55555574c2a8 "PATH= read 
-e < bar", from_file=0x5555556690f0 "-c", flags=4) at 
../../bash-5.0-rc1/builtins/evalstring.c:436
#18 0x000055555558564a in run_one_command (command=0x7fffffffe2a6 "PATH= read 
-e < bar") at ../bash-5.0-rc1/shell.c:1426
#19 0x0000555555584789 in main (argc=5, argv=0x7fffffffe008, 
env=0x7fffffffe038) at ../bash-5.0-rc1/shell.c:741
(gdb) l
253     _rl_nsearch_abort (_rl_search_cxt *cxt)
254     {
255       rl_maybe_unsave_line ();
256       rl_clear_message ();
257       rl_point = cxt->save_point;
258       rl_mark = cxt->save_mark;
259       rl_restore_prompt ();
260
261       RL_UNSETSTATE (RL_STATE_NSEARCH);
262     }
(gdb) c
Continuing.

malloc: unknown:0: assertion botched
malloc: 0x555555769408: allocated: last allocated from unknown:0
realloc: start and end chunk sizes differ
Aborting...
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.


diff -ruN bash-5.0-rc1.orig/lib/readline/search.c 
bash-5.0-rc1/lib/readline/search.c
--- bash-5.0-rc1.orig/lib/readline/search.c     2019-01-03 13:14:43.428392927 
-0800
+++ bash-5.0-rc1/lib/readline/search.c  2019-01-07 01:39:44.245179141 -0800
@@ -255,6 +255,8 @@
   rl_maybe_unsave_line ();
   rl_clear_message ();
   rl_point = cxt->save_point;
+  if (rl_point > rl_end)
+    rl_point = rl_end;
   rl_mark = cxt->save_mark;
   rl_restore_prompt ();



I wonder if this should be a macro or if there is a better way to ensure that
rl_point is never greater than rl_end.