NetBSD Problem Report #60593

From www@netbsd.org  Fri Aug 14 22:32:04 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 79EB11A923B
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 14 Aug 2026 22:32:04 +0000 (UTC)
Message-Id: <20260814223203.369FE1A923C@mollari.NetBSD.org>
Date: Fri, 14 Aug 2026 22:32:03 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: libedit: buffer overruns and arithmetic overflow
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60593
>Notify-List:    mlichvar@redhat.com
>Category:       lib
>Synopsis:       libedit: buffer overruns and arithmetic overflow
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Aug 14 22:35:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sat Aug 15 20:21:11 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9
>Organization:
The NetBSD Editation, Inc.
>Environment:
>Description:

1.	In libedit/readline.c getfrom, a 2021 fix for an off-by-one
	error in a bounds check (to verify that there is space in the
	buffer for len bytes plus a NUL byte) inadvertently turned it
	into an off-by-two error in a bounds check:

    693 	char *what = el_realloc(*fromp, size * sizeof(*what));
...
    699 	for (; *cmd && *cmd != delim; cmd++) {
    700 		if (*cmd == '\\' && cmd[1] == delim)
    701 			cmd++;
 => 702 		if (len - 1 >= size) {
    703 			char *nwhat;
    704 			nwhat = el_realloc(what, (size <<= 1) * sizeof(*nwhat));
    705 			if (nwhat == NULL) {
    706 				el_free(what);
    707 				el_free(*fromp);
    708 				*cmdp = cmd;
    709 				*fromp = NULL;
    710 				return 0;
    711 			}
    712 			what = nwhat;
    713 		}
    714 		what[len++] = *cmd;
    715 	}
    716 	what[len] = '\0';

https://nxr.netbsd.org/xref/src/lib/libedit/readline.c?r=1.184#687

	The attempted fix was in rev. 1.166:

@@ -676,7 +674,7 @@ getfrom(const char **cmdp, char **fromp, const char *search, int delim)
 	for (; *cmd && *cmd != delim; cmd++) {
 		if (*cmd == '\\' && cmd[1] == delim)
 			cmd++;
-		if (len >= size) {
+		if (len - 1 >= size) {
 			char *nwhat;
 			nwhat = el_realloc(what, (size <<= 1) * sizeof(*nwhat));
 			if (nwhat == NULL) {

	Additionally, size << 1 (i.e., size * 2) could in principle
	overflow; should verify size < SIZE_MAX/2/sizeof(*nwhat) before
	computing (size << 1) * sizeof(*nwhat).

2. 	Possible three-wchar buffer overrun in vi mode searching:

     73 	el->el_search.patbuf = el_calloc(EL_BUFSIZ,
     74 	    sizeof(*el->el_search.patbuf));
...
    489 		if (el->el_search.patbuf[0] != '.' &&
    490 		    el->el_search.patbuf[0] != '*') {
    491 			(void) wcsncpy(tmpbuf, el->el_search.patbuf,
    492 			    sizeof(tmpbuf) / sizeof(*tmpbuf) - 1);
    493 			el->el_search.patbuf[0] = '.';
    494 			el->el_search.patbuf[1] = '*';
    495 			(void) wcsncpy(&el->el_search.patbuf[2], tmpbuf,
    496 			    EL_BUFSIZ - 3);
    497 			el->el_search.patlen++;
    498 			el->el_search.patbuf[el->el_search.patlen++] = '.';
    499 			el->el_search.patbuf[el->el_search.patlen++] = '*';
    500 			el->el_search.patbuf[el->el_search.patlen] = '\0';
    501 		}

https://nxr.netbsd.org/xref/src/lib/libedit/search.c?r=1.53#488

	If, on input, the search already has a maximum-length patbuf
	(and I see no way to rule this out), el->el_search.patlen++ may
	advance past the end of the buffer.

	Reported by Miroslav Lichvar <mlichvar@redhat.com>.

>How-To-Repeat:

	code inspection
	abuse^Wheavy use of interactive history editing or search features


>Fix:

1.	Fix the bounds check by saying `+ 1' instead of `- 1', and
	check for arithmetic overflow.

2.	Fail if el->el_search.patlen >= EL_BUFSIZE - 3.

>Release-Note:

>Audit-Trail:

From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60593 CVS commit: src/lib/libedit
Date: Sat, 15 Aug 2026 05:18:59 -0400

 Module Name:	src
 Committed By:	christos
 Date:		Sat Aug 15 09:18:59 UTC 2026

 Modified Files:
 	src/lib/libedit: readline.c

 Log Message:
 PR/60593: Miroslav Lichvar: Protect against integer overflow and fix incorrect
 bounds check.


 To generate a diff of this commit:
 cvs rdiff -u -r1.184 -r1.185 src/lib/libedit/readline.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60593 CVS commit: src/lib/libedit
Date: Sat, 15 Aug 2026 05:19:30 -0400

 Module Name:	src
 Committed By:	christos
 Date:		Sat Aug 15 09:19:29 UTC 2026

 Modified Files:
 	src/lib/libedit: search.c

 Log Message:
 PR/60593: Miroslav Lichvar: Make sure there is space before appending to the
 pattern buffer.


 To generate a diff of this commit:
 cvs rdiff -u -r1.53 -r1.54 src/lib/libedit/search.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60593 CVS commit: src/lib/libedit
Date: Sat, 15 Aug 2026 13:27:31 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Aug 15 13:27:30 UTC 2026

 Modified Files:
 	src/lib/libedit: readline.c

 Log Message:
 libedit: Use the standard SIZE_MAX, not nonstandard SIZE_T_MAX.

 Cleanup after:

 PR lib/60593: libedit: buffer overruns and arithmetic overflow


 To generate a diff of this commit:
 cvs rdiff -u -r1.186 -r1.187 src/lib/libedit/readline.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: gutteridge@NetBSD.org
State-Changed-When: Sat, 15 Aug 2026 20:21:11 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10, maybe pullup-9

>Unformatted:

Home	PR Database Search