jarun/nnn

Opening the help screen corrupts global variables

r-darwish opened this issue · 4 comments

r-darwish commented

Environment details (Put x in the checkbox along with the information)

  • Operating System: macOS 13.6.1 (22G313) (Intel CPU)
  • Desktop Environment: macOS
  • Terminal Emulator: kitty
  • Shell: zsh
  • Custom desktop opener (if applicable):
  • Program options used: default
  • Configuration options set: default
  • Plugins are installed: None
  • Issue exists on nnn master: yes

Exact steps to reproduce the issue

  1. Open nnn
  2. Launch the help screen with ?
  3. Quit with q
nnn(94221,0x7ff854795700) malloc: *** error for object 0x2020202020202020: pointer being freed was not allocated
nnn(94221,0x7ff854795700) malloc: *** set a breakpoint in malloc_error_break to debug
zsh: abort      ./nnn

The problem occur here:

nnn/src/nnn.c

Lines 5175 to 5186 in 744a755

for (const char *s = helpstr; s < end; ++s) {
if (hex) {
for (int k = 0, n = xchartohex(*s); k < n; ++k) *w++ = ' ';
} else if (*s == '%') {
int n = ((s[1] - '0') * 10) + (s[2] - '0');
for (int k = 0; k < n; ++k) *w++ = ' ';
s += 2;
} else {
*w++ = *s;
}
hex = *s == '\n';
}

as g_buf isn't large enough to contain the entire help output, so it starts overriding the value in other global variables

N-R-K commented

as g_buf isn't large enough to contain the entire help output

What's the size of g_buf for you? I suspect macos has PATH_MAX and/or NAME_MAX set to really low values.

r-darwish commented

1536 bytes

image

jarun commented

I think we need to have a guard against crossing the length.
Can someone raise a PR?

N-R-K commented

I'll fix it soon and send a PR.