NetBSD Problem Report #60570

From www@netbsd.org  Mon Aug 10 19:42:36 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id C341D1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 10 Aug 2026 19:42:36 +0000 (UTC)
Message-Id: <20260810194235.9546A1A923C@mollari.NetBSD.org>
Date: Mon, 10 Aug 2026 19:42:35 +0000 (UTC)
From: loganjerry@gmail.com
Reply-To: loganjerry@gmail.com
To: gnats-bugs@NetBSD.org
Subject: [libedit] Possible NULL dereference in stifle_history
X-Send-Pr-Version: www-1.0
X-From4GNATS: "loganjerry@gmail.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60570
>Category:       lib
>Synopsis:       [libedit] Possible NULL dereference in stifle_history
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    lib-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 10 19:45:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sat Aug 15 15:02:06 +0000 2026
>Originator:     Jerry James
>Release:        11.0
>Organization:
>Environment:
Linux diannao.lan 7.1.7-200.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Aug  6 21:13:02 UTC 2026 x86_64 GNU/Linux
>Description:
I maintain the libedit package for the Fedora Linux distribution, thanks to Jess Thrysoee's port. The remove_history function can return NULL; e.g., if memory allocation fails. However, the code in stifle_history assumes the return value is non-NULL. The included patch adds the missing NULL check prior to dereferencing the pointer.
>How-To-Repeat:
Actually causing a crash is difficult. This is just my attempt at eliminating a theoretically possible crash.
>Fix:
Index: lib/libedit/readline.c
===================================================================
RCS file: /cvsroot/src/lib/libedit/readline.c,v
retrieving revision 1.184
diff -u -r1.184 readline.c
--- lib/libedit/readline.c	9 Jan 2026 17:49:12 -0000	1.184
+++ lib/libedit/readline.c	10 Aug 2026 19:20:18 -0000
@@ -1246,9 +1246,11 @@
 			history_base = history_length - max;
 		while (history_length > max) {
 			he = remove_history(0);
-			el_free(he->data);
-			el_free((void *)(unsigned long)he->line);
-			el_free(he);
+			if (he != NULL) {
+				el_free(he->data);
+				el_free((void *)(unsigned long)he->line);
+				el_free(he);
+			}
 		}
 	}
 }

>Release-Note:

>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60570 CVS commit: src/lib/libedit
Date: Sat, 15 Aug 2026 05:23:14 -0400

 Module Name:	src
 Committed By:	christos
 Date:		Sat Aug 15 09:23:14 UTC 2026

 Modified Files:
 	src/lib/libedit: readline.c

 Log Message:
 PR/60570: Jerry James: Prevent NULL derefence on allocation failure.


 To generate a diff of this commit:
 cvs rdiff -u -r1.185 -r1.186 src/lib/libedit/readline.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 15 Aug 2026 15:02:06 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10, pullup-9


>Unformatted:

Home	PR Database Search