Re: readline crash with custom .inputrc

[Chet Ramey]

On 1/26/21 7:33 AM, Matthias Klose wrote:
> This was reported for Debian in https://bugs.debian.org/968703 for the
> interactive Python interpreter, however I also see it with gdb, e.g. trying to
> run ls in gdb. readline 8.1 is in use.

This one has been around ever since the callback code came in in 2005.

These are the problem key bindings (thanks to Koichi Murase for isolating
them):

> "\C-M-b": backward-word
> "\C-M-f": forward-word
This gives you two multi-character key sequences beginning with ^M (RET),
which turns out to matter.

> just hitting return in interactive mode triggers the segfault.

It takes two returns. The sequences of events goes something like this.

1. The user hits return. It's ambiguous, so readline waits for another
   character to decide what to do.

2. The user hits return. At this point, readline knows that the first ^M
   means a RET, and, since it's bound to accept-line, cleans things up and
   returns the (empty) line to the application by calling the line
   function.

3. As part of its ine processing, the application unregisters the line
   callback function.

4. Readline notes there is pending input (the second newline), collects it,
   calls accept-line again, and goes through the process of cleaning up and
   calling the line handler. Unfortunately, this time, the application has
   already removed the line handler, and readline attempts to call through
   a NULL function pointer. This is where the core dump happens.

The obvious quick fix is to correct the bad keybindings.

--
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    chet@case.edu    http://tiswww.cwru.edu/~chet/