bugGNU roff - Bugs: bug #46470, Global out of bounds read in troff...


bug #46470: Global out of bounds read in troff in function make_glyph_node

Submitter:  Hanno Boeck <hanno>
Submitted:  Wed 18 Nov 2015 09:34:42 AM UTC
Category:  Core Severity:  2 - Minor
Item Group:  Lint Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup

Thu 19 May 2022 11:12:02 AM UTC, comment #3: 

It sounds like this non-default compiler warning does not indicate the presence of incorrect program operation.

Updating Item Group and Severity accordingly.

The formatter does complain.

$ printf '\\(' | ./build/test-groff -Tutf8 | cat -s
troff: error: end of input in escape sequence
troff: warning: can't find special character ''

G. Branden Robinson <gbranden>
Group administrator
Fri 18 Feb 2022 02:46:49 PM UTC, comment #2: 


  My remark was about the compilation of groff.

  If a such compiled version of groff is used on the input file, it
shows the same bug.

  Command is "test-groff troff-global-oob"

  The output is in the attachment (groff-asan.bug).

(file #52880)

Bjarni Ingi Gislason <bjarniig>
Fri 18 Feb 2022 03:49:25 AM UTC, comment #1: 

  With a gcc compiler option "-fsanitize=address" I see no
"global-buffer-overflow", but memory leaks (bug #57516).

Bjarni Ingi Gislason <bjarniig>
Wed 18 Nov 2015 09:34:42 AM UTC, original submission:  

The attached file will cause a global out of bounds read in the troff tool. This can be seen with address sanitizer (-fsanitize=address in cflags).

The file consists just of two bytes ("\("). This was found with american fuzzy lop.

I'll also attach the full address sanitizer stack trace.

Hanno Boeck <hanno>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #52880:  groff-asan.bug added by bjarniig (4KiB - application/octet-stream)
file #35490:  troff-global-oob added by hanno (2B - application/octet-stream)
file #35491:  troff-asan-error.txt added by hanno (3KiB - text/plain)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by gbranden (Posted a comment)
  • -email is unavailable- added by bjarniig (Posted a comment)
  • -email is unavailable- added by bgarrigues (Updated the item)
  • -email is unavailable- added by hanno (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-05-19 gbranden Severity3 - Normal 2 - Minor
        Item GroupIncorrect behaviour Lint
    2022-02-18 bjarniig Attached File- Added groff-asan.bug, #52880
    2017-09-01 bgarrigues CategoryNone Core
        Item GroupNone Incorrect behaviour
    2015-11-18 hanno Attached File- Added troff-global-oob, #35490
        Attached File- Added troff-asan-error.txt, #35491

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code