Andreas Mohr 8a6b2cb91c Ticket #4425: (mc_search__change_case_str): fix heap buffer overflow.
Normal start result in this AddressSanitizer hit.

=================================================================
==17167==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200005b251 at pc 0x5983b1c3be5f bp 0x7ffcc27f4310 sp 0x7ffcc27f4308
WRITE of size 1 at 0x60200005b251 thread T0
    #0 0x5983b1c3be5e in mc_search__change_case_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/lib.c:84:14
    #1 0x5983b1c3c03f in mc_search__toupper_case_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/lib.c:200:12
    #2 0x5983b1d1b434 in mc_search__cond_struct_new_regex_hex_add /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:130:11
    #3 0x5983b1d1ad7f in mc_search__cond_struct_new_regex_accum_append /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:180:17
    #4 0x5983b1d147c9 in mc_search__cond_struct_new_regex_ci_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:251:5
    #5 0x5983b1d136fa in mc_search__cond_struct_new_init_regex /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:817:39
    #6 0x5983b1c3d7f0 in mc_search__cond_struct_new /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:80:9
    #7 0x5983b1c3d2e5 in mc_search_prepare /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:219:26
    #8 0x5983b1c3d9c3 in mc_search_run /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:297:10
    #9 0x5983b1c359f2 in mc_fhl_get_color_regexp /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/filehighlight/get-color.c:243:9
    #10 0x5983b1c35385 in mc_fhl_get_color /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/filehighlight/get-color.c:278:19
    #11 0x5983b1a1208f in file_compute_color /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:784:12
    #12 0x5983b1a10bfd in format_file /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:814:17
    #13 0x5983b1a0fb17 in repaint_file /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:954:15
    #14 0x5983b1a0c0b6 in paint_dir /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:1071:9
    #15 0x5983b19fab96 in panel_callback /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:3731:9
    #16 0x5983b1d08775 in widget_draw /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/widget-common.c:539:19
    #17 0x5983b1d078eb in widget_default_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/widget-common.c:841:17
    #18 0x5983b1cb3c0b in widget_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/../../lib/widget/widget-common.h:383:12
    #19 0x5983b1cb286c in group_default_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/group.c:691:17
    #20 0x5983b1caa8ab in widget_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/../../lib/widget/widget-common.h:383:12
    #21 0x5983b1cacd14 in dlg_init /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/dialog.c:540:5
    #22 0x5983b1cada9d in dlg_run /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/dialog.c:601:5
    #23 0x5983b19cddd9 in do_nc /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/filemanager.c:1827:16
    #24 0x5983b1999605 in main /tmp/portage/app-misc/mc-9999/work/mc-9999/src/main.c:455:21
    #25 0x7d3944d620cb  (/lib64/libc.so.6+0x220cb)
    #26 0x7d3944d6217b in __libc_start_main (/lib64/libc.so.6+0x2217b)
    #27 0x5983b18d7d10 in _start (/usr/bin/mc+0x277d10)

0x60200005b251 is located 0 bytes to the right of 1-byte region [0x60200005b250,0x60200005b251)
allocated by thread T0 here:
    #0 0x5983b195ee89 in malloc (/usr/bin/mc+0x2fee89)
    #1 0x7d3945014ef9 in g_malloc (/usr/lib64/libglib-2.0.so.0+0x54ef9)
    #2 0x5983b1c3c03f in mc_search__toupper_case_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/lib.c:200:12
    #3 0x5983b1d1b434 in mc_search__cond_struct_new_regex_hex_add /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:130:11
    #4 0x5983b1d1ad7f in mc_search__cond_struct_new_regex_accum_append /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:180:17
    #5 0x5983b1d147c9 in mc_search__cond_struct_new_regex_ci_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:251:5
    #6 0x5983b1d136fa in mc_search__cond_struct_new_init_regex /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:817:39
    #7 0x5983b1c3d7f0 in mc_search__cond_struct_new /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:80:9
    #8 0x5983b1c3d2e5 in mc_search_prepare /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:219:26
    #9 0x5983b1c3d9c3 in mc_search_run /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:297:10
    #10 0x5983b1c359f2 in mc_fhl_get_color_regexp /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/filehighlight/get-color.c:243:9
    #11 0x5983b1c35385 in mc_fhl_get_color /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/filehighlight/get-color.c:278:19
    #12 0x5983b1a1208f in file_compute_color /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:784:12
    #13 0x5983b1a10bfd in format_file /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:814:17
    #14 0x5983b1a0fb17 in repaint_file /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:954:15
    #15 0x5983b1a0c0b6 in paint_dir /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:1071:9
    #16 0x5983b19fab96 in panel_callback /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:3731:9
    #17 0x5983b1d08775 in widget_draw /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/widget-common.c:539:19
    #18 0x5983b1d078eb in widget_default_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/widget-common.c:841:17
    #19 0x5983b1cb3c0b in widget_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/../../lib/widget/widget-common.h:383:12
    #20 0x5983b1cb286c in group_default_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/group.c:691:17
    #21 0x5983b1caa8ab in widget_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/../../lib/widget/widget-common.h:383:12
    #22 0x5983b1cacd14 in dlg_init /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/dialog.c:540:5
    #23 0x5983b1cada9d in dlg_run /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/dialog.c:601:5
    #24 0x5983b19cddd9 in do_nc /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/filemanager.c:1827:16
    #25 0x5983b1999605 in main /tmp/portage/app-misc/mc-9999/work/mc-9999/src/main.c:455:21
    #26 0x7d3944d620cb  (/lib64/libc.so.6+0x220cb)

SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/lib.c:84:14 in mc_search__change_case_str
Shadow bytes around the buggy address:
  0x0c04800035f0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c0480003600: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480003610: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c0480003620: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480003630: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0x0c0480003640: fa fa fd fa fa fa fd fa fa fa[01]fa fa fa fa fa
  0x0c0480003650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480003660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480003670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480003680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480003690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==17167==ABORTING

Found by clang 15.

Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Andrew Borodin <aborodin@vmail.ru>
2023-01-14 15:43:00 +03:00
..
2017-11-17 15:59:44 +03:00

Contents
--------

Introduction
Dependencies
Features
Mini-documentation
Where to get more information
Reporting problems


Introduction
------------

GNU Midnight Commander (also referred to as MC) is a user shell with
text-mode full-screen interface.  It can be run on the OS console,
in xterm and other terminal emulators.

GNU Midnight Commander allows you to manage files while making the most of
your screen and giving you a clear representation of the filesystem, yet
it's simple enough to be run over a telnet or ssh session.

GNU Midnight Commander is released under the GNU General Public
License version 3 or any later version.  A copy of the file is
included with this distribution package.


Dependencies
------------

Please read the file INSTALL for installation instructions
and full list of dependencies.


Features
--------

GNU Midnight Commander was conceived as a free clone of John Socha's
Norton Commander (TM).  It also takes the best from more recent software
with similar interfaces.  GNU Midnight Commander comes with mouse support
on xterm and optionally on the Linux console.

Some features are specific to the POSIX environment MC runs on, some are
familiar to the users of similar software for other operating systems.
The features include:

	* Built in Virtual File System: manipulate remote file systems
          through the FTP and SFTP protocols or over secure shell, browse
          contents of tar, ar, rpm, zip, cpio, lha and rar archives just
	  like local files.

	* Almost all operations work with the virtual file system,
	  enabling you to do complex tasks, like viewing files in
	  archives on an FTP server.

	* Mouse support on most terminal emulators for X Window System
	  as well as on the Linux console.

	* Learn Keys: GNU Midnight Commander may be configured at run
	  time to support any kind of input keys for a given terminal,
	  making its operation possible even on most weird terminals.

	* Text and hex editors are available for you to use (hex editor
	  is a part of the viewer).

	* Hotlist allows you to keep a list of common visited locations,
	  including remote sites and directories inside archives.

	* Command completion: By pressing Alt-Tab in any place where a
	  filename or an executable are expected, GNU Midnight Commander
	  will complete the name for you.  If you press Alt-Tab for the
	  second time, you get a list box with all possible completions.

	* Subshell support: Run your commands by a real shell
	  interpreter.  GNU Midnight Commander interacts with bash,
	  tcsh and zsh to provide you with all of the facilities
	  available in your preferred shell.

	* Find file command can search for the file contents.

	* Background operations allow you to copy or move files from
	  any virtual file system while you do other tasks (i.e., you
	  can do background FTP copies).

	* FTP proxy is supported.

	* Linux file recovery: If you are using Linux, you can recover
	  deleted files from an ext2 or ext3 partition with the undelete
	  file system.  This is a low level file recovery function that
	  can recover files deleted by any program on Linux.

	* External panelization: You can run any arbitrary external
	  command and GNU Midnight Commander will display the output
	  generated as a file listing that can be manipulated as a
	  regular directory.

	* Emacs-like key bindings are used in all widgets.

	* Context dependent actions (open, view, edit) are available.

	* The built-in file viewer, together with the context dependent
	  actions is used to format man pages on the fly, coloring mail
	  messages and more.

	* The built-in editor supports syntax highlighting and external
	  actions, such as spell checking and formatting.


Mini-documentation
------------------

These are hints for the text mode edition:

* Use the F-Keys for invoking the commands in the function key bar.
  If your terminal doesn't support F-keys, you can use the <ESC digit>
  sequence to invoke the corresponding F-digit key.

* Tab changes the current panel.

* All input lines have emacs-like key-bindings (command history is
  accessed through the M-p and M-n keys).

* The panels accept C-n, C-p for browsing the panel (like in Emacs).

* M-Enter copies the currently selected file name to the input line.

* M-Tab completes the current word (or tries to).

* The Virtual File System is a cute addition to the project, you may
  browse in tar and compressed tar files as well as browsing remote
  machines with the fish file system.

* Please read the manual page.

You can access the whole documentation online with the F1 key,
although it's not as nice as the groff printed manual page :-)


Where to get more information
-----------------------------

There is a webpage for GNU Midnight Commander at

https://www.midnight-commander.org/

This page also has current information about mailing lists and some
useful advices how to report bugs.

You can download the latest version of GNU Midnight Commander from

https://www.midnight-commander.org/downloads/


Reporting problems
------------------

You can report bug on our site, please read 

https://www.midnight-commander.org/wiki/doc/reportDefects

Also you can use mc mailing lists to discuss problems.

There are two mailing lists:

  - mc@lists.midnight-commander.org
  - mc-devel@lists.midnight-commander.org

Use mc-devel@ if you are prepared for a more technical discussion
with the developers of the package, otherwise use mc@.

Please don't sent HTML e-mail to either of those mailing lists.

Include the output of "mc --version", the operating system and the
distribution (if applicable) you are using, the compiler and the
configure flags used to compile the program (if you know them).

If the program crashed and produced a core dump, please provide a
stack trace of the program.

You can do this by running gdb like this:

gdb mc core
(gdb) where