[ python-Bugs-1086603 ] segfault in readline

[SourceForge.net]

Bugs item #1086603, was opened at 2004-12-16 19:02
Message generated for change (Comment added) made by loewis
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1086603&group_id=5470

Category: Python Library
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Submitted By: DSM (dsm001)
Assigned to: Nobody/Anonymous (nobody)
Summary: segfault in readline

Initial Comment:
It's possible to produce segfaults using two functions
from the
readline module by giving them negative values (GNU
readline 4.3-10),
at least in some circumstances.  

Python 2.5a0 (#10, Dec 15 2004, 19:53:33) 
[GCC 3.3.3 (Debian 20040401)] on linux2
Type "help", "copyright", "credits" or "license" for
more information.
>>> import readline
[25290 refs]
>>> readline.remove_history_item(-1)
Segmentation fault

>>> readline.replace_history_item(-1,'abc')
Segmentation fault

gdb reveals it happens because the (external)
remove_history and replace_history_entry don't return
NULL in these cases.  I'm not sure whether we're
responsible for checking the sanity of inputs or the
GNU code should be returning NULL and isn't, but at
least sometimes it doesn't.

----------------------------------------------------------------------

>Comment By: Martin v. Löwis (loewis)
Date: 2005-03-03 12:13

Message:
Logged In: YES 
user_id=21627

This should be now fixed with patch 1093585.

----------------------------------------------------------------------

Comment By: Björn Lindqvist (sonderblade)
Date: 2005-01-12 00:07

Message:
Logged In: YES 
user_id=51702

I can confirm the bug with readline 4.3 and Python 2.5a0
(#1, Jan 11 2005, 23:22:16). dsm001's patch fixes it.

----------------------------------------------------------------------

Comment By: DSM (dsm001)
Date: 2004-12-31 03:32

Message:
Logged In: YES 
user_id=1175690

This one being simple enough for the likes of me to patch, I
did so -- 1093585.  Let the school of hard knocks begin!

----------------------------------------------------------------------

Comment By: George Yoshida (quiver)
Date: 2004-12-20 11:57

Message:
Logged In: YES 
user_id=671362

I'm +1 for sanity checking rather than waiting for the GNU
readline to return NULL in these functions.

It's just adding a few lines of code right after 
PyArg_ParseTuple :

  if (entry_number < 0) {
    PyErr_SetString(PyExc_ValueError,
                    "index cannot be a negative value");
    return NULL;
  }

Then you can work around the problem without worrying 
about the return value of remove_history nor 
replace_history_entry.


----------------------------------------------------------------------

Comment By: Michael Hudson (mwh)
Date: 2004-12-19 17:41

Message:
Logged In: YES 
user_id=6656

Do you want to fix it then? :)  I can't imagine it's that hard, but it would 
be easier for someone who can test that their fix helps...

----------------------------------------------------------------------

Comment By: George Yoshida (quiver)
Date: 2004-12-18 11:45

Message:
Logged In: YES 
user_id=671362

FYI, I can reproduce this with :

- Python 2.4 & readline 4.3 under SuSE 9.1
- Python 2.5(snapshot as of 2004-12-17) & readline 4.3 under 
SuSE 9.1
- Python 2.4 & readline 4.3.5(?) under Cygwin



----------------------------------------------------------------------

Comment By: Michael Hudson (mwh)
Date: 2004-12-17 15:18

Message:
Logged In: YES 
user_id=6656

Hmm.  I can't reproduce this (also with readline 4.3).  Odd.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1086603&group_id=5470