#51201: nano crashes when opening multiple files: use-after-free ------------------------+------------------------ Reporter: jeremyhu@… | Owner: jeremyhu@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.3.4 Keywords: | Port: nano ------------------------+------------------------ Using nano to open many files at once often causes the process to crash. Building with ASan reveals that this is a use-after-free. The issue seems to be that nano is feeing memory that it doesn't own, so the next time dirname(3) goes to use its buffer, nano crashes. {{{ Process: nano [10512] Path: /opt/local/bin/nano Identifier: nano Version: 0 Code Type: X86-64 (Native) Parent Process: bash [4236] Responsible: Terminal [601] User ID: 501 Date/Time: 2016-04-21 20:33:52.998 -0700 OS Version: Mac OS X 10.11.5 (15F25) Report Version: 11 Anonymous UUID: 1F70FDBA-936B-7CCF-17FE-84A1852F1452 Sleep/Wake UUID: 28E1E682-A8AE-48E8-AEBC-1DCC31235440 Time Awake Since Boot: 56000 seconds Time Since Wake: 700 seconds System Integrity Protection: enabled Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Application Specific Information: ================================================================= ==10512==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000400180 at pc 0x00010fb1654a bp 0x7fff50317860 sp 0x7fff50317020 WRITE of size 13 at 0x619000400180 thread T0 #0 0x10fb16549 in wrap_memcpy (libclang_rt.asan_osx_dynamic.dylib+0x42549) #1 0x7fff9c576266 in dirname (libsystem_c.dylib+0x26266) #2 0x10f8faa62 in has_valid_path files.c:46 #3 0x10f8fe51b in open_buffer files.c:452 #4 0x10f934cdc in main nano.c:2574 #5 0x7fff8acc05ac in start (libdyld.dylib+0x35ac) #6 0x26 (<unknown module>) 0x619000400180 is located 0 bytes inside of 1024-byte region [0x619000400180,0x619000400580) freed by thread T0 here: #0 0x10fb1e1c9 in wrap_free (libclang_rt.asan_osx_dynamic.dylib+0x4a1c9) #1 0x10f8fac72 in has_valid_path files.c:62 #2 0x10f8fe51b in open_buffer files.c:452 #3 0x10f934cdc in main nano.c:2574 #4 0x7fff8acc05ac in start (libdyld.dylib+0x35ac) #5 0x26 (<unknown module>) previously allocated by thread T0 here: #0 0x10fb1e000 in wrap_malloc (libclang_rt.asan_osx_dynamic.dylib+0x4a000) #1 0x7fff9c576199 in dirname (libsystem_c.dylib+0x26199) #2 0x10f8faa62 in has_valid_path files.c:46 #3 0x10f8fe51b in open_buffer files.c:452 #4 0x10f934cdc in main nano.c:2574 #5 0x7fff8acc05ac in start (libdyld.dylib+0x35ac) #6 0x26 (<unknown module>) SUMMARY: AddressSanitizer: heap-use-after-free (libclang_rt.asan_osx_dynamic.dylib+0x42549) in wrap_memcpy Shadow bytes around the buggy address: 0x1c320007ffe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c320007fff0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200080000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200080010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c3200080020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x1c3200080030:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200080040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200080050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200080060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200080070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200080080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==10512==ABORTING abort() called Global Trace Buffer (reverse chronological seconds): 18446744068.605698 libclang_rt.asan_osx_dynamic.dylib 0x000000010fb34757 Consult syslog for more information. 18446744068.605705 libclang_rt.asan_osx_dynamic.dylib 0x000000010fb346de Address Sanitizer reported a failure. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsystem_kernel.dylib 0x00007fff8d315f06 __pthread_kill + 10 1 libsystem_pthread.dylib 0x00007fff86bfc4ec pthread_kill + 90 (pthread.c:1249) 2 libsystem_c.dylib 0x00007fff9c5ae6e7 abort + 129 3 libclang_rt.asan_osx_dynamic.dylib 0x000000010fb3e426 __sanitizer::Abort() + 6 4 libclang_rt.asan_osx_dynamic.dylib 0x000000010fb16577 wrap_memcpy + 1623 5 libsystem_c.dylib 0x00007fff9c576267 dirname + 240 6 nano 0x000000010f8faa63 has_valid_path + 339 (files.c:46) 7 nano 0x000000010f8fe51c open_buffer + 1068 (files.c:452) 8 nano 0x000000010f934cdd main + 14077 (nano.c:2574) 9 libdyld.dylib 0x00007fff8acc05ad start + 1 Thread 0 crashed with X86 Thread State (64-bit): rax: 0x0000000000000000 rbx: 0x0000000000000006 rcx: 0x00007fff503165c8 rdx: 0x0000000000000000 rdi: 0x000000000000050f rsi: 0x0000000000000006 rbp: 0x00007fff503165f0 rsp: 0x00007fff503165c8 r8: 0x000000010fff7c53 r9: 0x0000000000000012 r10: 0x0000000008000000 r11: 0x0000000000000206 r12: 0x000000010fb4c67e r13: 0x00007fff50316fb0 r14: 0x00007fff76102000 r15: 0x000000010fda60a0 rip: 0x00007fff8d315f06 rfl: 0x0000000000000206 cr2: 0x00007fff7a51e008 Logical CPU: 0 Error Code: 0x02000148 Trap Number: 133 Binary Images: 0x10f8e7000 - 0x10f9a0ff7 +nano (0) <E06CEF76-F178-3094-A470-9FC42817F9EB> /opt/local/bin/nano 0x10f9e2000 - 0x10f9eaff3 +libintl.8.dylib (0) <923E20D2 -F8BE-3A24-88D8-59834B8F7CA5> /opt/local/lib/libintl.8.dylib 0x10f9f5000 - 0x10fa11fff +libz.1.dylib (0) <AC3687FA- B3A3-37F5-9152-EABA1C013A0C> /opt/local/lib/libz.1.dylib 0x10fa1c000 - 0x10fa33ff7 +libmagic.1.dylib (0) <6FADBBE1-BB34-36BB-80CE-DAD234D17D89> /opt/local/lib/libmagic.1.dylib 0x10fa3f000 - 0x10fa9efff +libncurses.6.dylib (0) <42688968-AAEA-3474-BD55-9652A6A286FD> /opt/local/lib/libncurses.6.dylib 0x10fad4000 - 0x10fb62ff7 +libclang_rt.asan_osx_dynamic.dylib (0) <2FD61E39-48A1-3B98-B3E1-D7C7C245A993> /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib 0x110840000 - 0x11094efff +libiconv.2.dylib (0) <6941818D- 37C9-3B88-BCA6-6D1E04A65F91> /opt/local/lib/libiconv.2.dylib 0x7fff628ec000 - 0x7fff6292325f dyld (360.22) <A468D85E- D8D6-3461-8C99-49D3B9ACFC63> /usr/lib/dyld 0x7fff86b5f000 - 0x7fff86b63fff libcache.dylib (75) <9548AAE9-2AB7-3525-9ECE-A2A7C4688447> /usr/lib/system/libcache.dylib 0x7fff86bf6000 - 0x7fff86bffff7 libsystem_pthread.dylib (138.10.4) <3DD1EF4C-1D1B-3ABF-8CC6-B3B1CEEE9559> /usr/lib/system/libsystem_pthread.dylib 0x7fff87f92000 - 0x7fff87f97ff7 libmacho.dylib (875.1) <318264FA- 58F1-39D8-8285-1F6254EE410E> /usr/lib/system/libmacho.dylib 0x7fff885fe000 - 0x7fff88601fff libsystem_sandbox.dylib (460.50.4) <150A9D3D-F69E-32F7-8C7B-8E72CAAFF7E4> /usr/lib/system/libsystem_sandbox.dylib 0x7fff8968c000 - 0x7fff89694fff libcopyfile.dylib (127) <A48637BC-F3F2-34F2-BB68-4C65FD012832> /usr/lib/system/libcopyfile.dylib 0x7fff8983e000 - 0x7fff89a4bfff libicucore.A.dylib (551.51.3) <5BC80F94-C90D-3175-BD96-FF1DC222EC9C> /usr/lib/libicucore.A.dylib 0x7fff8a879000 - 0x7fff8a8bfff7 libauto.dylib (186) <999E610F- 41FC-32A3-ADCA-5EC049B65DFB> /usr/lib/libauto.dylib 0x7fff8acbd000 - 0x7fff8acc0ffb libdyld.dylib (360.22) <CC088C2A-D407-33E7-A6B6-B06E0D4AD999> /usr/lib/system/libdyld.dylib 0x7fff8bc28000 - 0x7fff8bc28ff7 libkeymgr.dylib (28) <8371CE54 -5FDD-3CE9-B3DF-E98C761B6FE0> /usr/lib/system/libkeymgr.dylib 0x7fff8c80e000 - 0x7fff8c813ff3 libunwind.dylib (35.3) <F6EB48E5-4D12-359A-AB54-C937FBBE9043> /usr/lib/system/libunwind.dylib 0x7fff8c814000 - 0x7fff8c816ff7 libsystem_configuration.dylib (802.40.13) <3DEB7DF9-6804-37E1-BC83-0166882FF0FF> /usr/lib/system/libsystem_configuration.dylib 0x7fff8d2ff000 - 0x7fff8d31dff7 libsystem_kernel.dylib (3248.50.21) <78E54D59-D2B0-3F54-9A4A-0A68D671F253> /usr/lib/system/libsystem_kernel.dylib 0x7fff8d8ce000 - 0x7fff8dd44fff com.apple.CoreFoundation (6.9 - 1258.1) <943A1383-DA6A-3DC0-ABCD-D9AEB3D0D34D> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation 0x7fff8f4a8000 - 0x7fff8f4b3ff7 libcommonCrypto.dylib (60075.50.1) <93732261-34B4-3914-B7A2-90A81A182DBA> /usr/lib/system/libcommonCrypto.dylib 0x7fff8f7ef000 - 0x7fff8f7f7fff libsystem_networkextension.dylib (385.40.36) <66095DC7-6539-38F2-95EE-458F15F6D014> /usr/lib/system/libsystem_networkextension.dylib 0x7fff8f7f8000 - 0x7fff8f821ff7 libxpc.dylib (765.50.8) <54D1328E-054E-3DAA-89E2-375722F9D18F> /usr/lib/system/libxpc.dylib 0x7fff8f822000 - 0x7fff8f839ff7 libsystem_coretls.dylib (83.40.5) <C90DAE38-4082-381C-A185-2A6A8B677628> /usr/lib/system/libsystem_coretls.dylib 0x7fff8f954000 - 0x7fff8f97dfff libc++abi.dylib (125) <DCCC8177-3D09-35BC-9784-2A04FEC4C71B> /usr/lib/libc++abi.dylib 0x7fff8fab4000 - 0x7fff8fac5ff7 libz.1.dylib (61.20.1) <B3EBB42F- 48E3-3287-9F0D-308E04D407AC> /usr/lib/libz.1.dylib 0x7fff903b1000 - 0x7fff903cdff7 libsystem_malloc.dylib (67.40.1) <5748E8B2-F81C-34C6-8B13-456213127678> /usr/lib/system/libsystem_malloc.dylib 0x7fff9061d000 - 0x7fff90625fef libsystem_platform.dylib (74.40.2) <29A905EF-6777-3C33-82B0-6C3A88C4BA15> /usr/lib/system/libsystem_platform.dylib 0x7fff9068e000 - 0x7fff906bbfff libdispatch.dylib (501.40.12) <C7499857-61A5-3D7D-A5EA-65DCC8C3DF92> /usr/lib/system/libdispatch.dylib 0x7fff919db000 - 0x7fff919dbff7 libunc.dylib (29) <DDB1E947-C775-33B8-B461-63E5EB698F0E> /usr/lib/system/libunc.dylib 0x7fff9209c000 - 0x7fff920a3ff7 libcompiler_rt.dylib (62) <A13ECF69-F59F-38AE-8609-7B731450FBCD> /usr/lib/system/libcompiler_rt.dylib 0x7fff92764000 - 0x7fff9278dfff libsystem_info.dylib (477.50.4) <FAA9226D-64DE-3769-A6D8-6CABA4B7FF4D> /usr/lib/system/libsystem_info.dylib 0x7fff9278e000 - 0x7fff9278fffb libSystem.B.dylib (1226.10.1) <C5D09FE1-CC70-383E-AC27-18602F2EDEC4> /usr/lib/libSystem.B.dylib 0x7fff93717000 - 0x7fff93718fff libDiagnosticMessagesClient.dylib (100) <4243B6B4-21E9-355B-9C5A-95A216233B96> /usr/lib/libDiagnosticMessagesClient.dylib 0x7fff94209000 - 0x7fff9425cff7 libc++.1.dylib (120.1) <8FC3D139-8055-3498-9AC5-6467CB7F4D14> /usr/lib/libc++.1.dylib 0x7fff94ebb000 - 0x7fff94ec3ffb libsystem_dnssd.dylib (625.50.5) <4D10E12B-59B5-386F-82DA-326F18028F0A> /usr/lib/system/libsystem_dnssd.dylib 0x7fff95116000 - 0x7fff95127ff7 libsystem_trace.dylib (201.10.3) <F00E92E4-DBDA-3749-B5B3-0C3FBBABA1CB> /usr/lib/system/libsystem_trace.dylib 0x7fff958c9000 - 0x7fff95940feb libcorecrypto.dylib (335.50.1) <B5C05FD7-A540-345A-87BF-8E41848A3C17> /usr/lib/system/libcorecrypto.dylib 0x7fff95ec2000 - 0x7fff95ecbff3 libsystem_notify.dylib (150.40.1) <D48BDE34-0F7E-34CA-A0FF-C578E39987CC> /usr/lib/system/libsystem_notify.dylib 0x7fff9608e000 - 0x7fff96090fff libsystem_coreservices.dylib (19.2) <1B3F5AFC-FFCD-3ECB-8B9A-5538366FB20D> /usr/lib/system/libsystem_coreservices.dylib 0x7fff96276000 - 0x7fff96277ffb libremovefile.dylib (41) <552EF39E-14D7-363E-9059-4565AC2F894E> /usr/lib/system/libremovefile.dylib 0x7fff969ec000 - 0x7fff96d4ef3f libobjc.A.dylib (680) <7489D2D6-1EFD-3414-B18D-2AECCCC90286> /usr/lib/libobjc.A.dylib 0x7fff98beb000 - 0x7fff98bedff7 libquarantine.dylib (80) <0F4169F0-0C84-3A25-B3AE-E47B3586D908> /usr/lib/system/libquarantine.dylib 0x7fff995d6000 - 0x7fff995d6ff7 liblaunch.dylib (765.50.8) <834ED605-5114-3641-AA4D-ECF31B801C50> /usr/lib/system/liblaunch.dylib 0x7fff9b0a4000 - 0x7fff9b10aff7 libsystem_network.dylib (583.50.1) <B52DAB73-92DC-3DA7-B9F4-B899D66445C1> /usr/lib/system/libsystem_network.dylib 0x7fff9b9e3000 - 0x7fff9ba12ffb libsystem_m.dylib (3105) <08E1A4B2-6448-3DFE-A58C-ACC7335BE7E4> /usr/lib/system/libsystem_m.dylib 0x7fff9bad1000 - 0x7fff9bae8ff7 libsystem_asl.dylib (323.50.1) <41F8E11F-1BD0-3F1D-BA3A-AA1577ED98A9> /usr/lib/system/libsystem_asl.dylib 0x7fff9bfec000 - 0x7fff9bfedfff libsystem_blocks.dylib (65) <1244D9D5-F6AA-35BB-B307-86851C24B8E5> /usr/lib/system/libsystem_blocks.dylib 0x7fff9c52f000 - 0x7fff9c530fff libsystem_secinit.dylib (20) <32B1A8C6-DC84-3F4F-B8CE-9A52B47C3E6B> /usr/lib/system/libsystem_secinit.dylib 0x7fff9c550000 - 0x7fff9c5ddfff libsystem_c.dylib (1082.50.1) <B552D565-B798-3B9B-AE63-F623B42A5F01> /usr/lib/system/libsystem_c.dylib External Modification Summary: Calls made by other processes targeting this process: task_for_pid: 1 thread_create: 0 thread_set_state: 0 Calls made by this process: task_for_pid: 0 thread_create: 0 thread_set_state: 0 Calls made by all processes on this machine: task_for_pid: 31953 thread_create: 0 thread_set_state: 0 VM Region Summary: ReadOnly portion of Libraries: Total=109.0M resident=0K(0%) swapped_out_or_unallocated=109.0M(100%) Writable regions: Total=14.0T written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=14.0T(100%) VIRTUAL REGION REGION TYPE SIZE COUNT (non-coalesced) =========== ======= ======= Activity Tracing 2048K 2 Kernel Alloc Once 4K 2 MALLOC 4K 2 Performance tool data 6.0T 171 not counted in TOTAL below Performance tool data (reserved) 14.0T 55 reserved VM address space (unallocated) STACK GUARD 56.0M 2 Stack 8192K 2 VM_ALLOCATE 4K 2 __DATA 15.6M 60 __LINKEDIT 92.0M 10 __TEXT 17.0M 52 __UNICODE 552K 2 shared memory 12K 4 =========== ======= ======= TOTAL 191.2M 129 TOTAL, minus reserved VM space 16777202.0T 129 Model: MacBookPro11,5, BootROM MBP114.0172.B09, 4 processors, Intel Core i7, 2.8 GHz, 16 GB, SMC 2.30f2 Graphics: AMD Radeon R9 M370X, AMD Radeon R9 M370X, PCIe, 2048 MB Graphics: Intel Iris Pro, Intel Iris Pro, Built-In Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x802C, 0x31364B544631473634485A2D314736453120 Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x802C, 0x31364B544631473634485A2D314736453120 AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x152), Broadcom BCM43xx 1.0 (7.21.95.175.1a6) Bluetooth: Version 4.4.5f3 17904, 3 services, 27 devices, 1 incoming serial ports Network Service: Wi-Fi, AirPort, en0 Serial ATA Device: APPLE SSD SM1024G, 1 TB USB Device: USB 3.0 Bus USB Device: Apple Internal Keyboard / Trackpad USB Device: Bluetooth USB Host Controller Thunderbolt Bus: MacBook Pro, Apple Inc., 27.1 }}} -- Ticket URL: <https://trac.macports.org/ticket/51201> MacPorts <https://www.macports.org/> Ports system for OS X