bugGNU roff - Bugs: bug #65427, [troff] SEGV after invalidation of...

 
 

bug #65427: [troff] SEGV after invalidation of output file stream

Submitter:  None
Submitted:  Wed 06 Mar 2024 10:34:05 PM UTC
   
 
Category:  Core Severity:  4 - Important
Item Group:  Crash/Unresponsive Status:  Fixed
Privacy:  Public Assigned to:  gbranden
Open/Closed:  Closed Planned Release:  1.24.0
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Thu 07 Mar 2024 11:41:23 PM UTC, comment #2: 

Submitter, please confirm this fix on your system.

You can cherry-pick the commit if you like.


commit 5c923303a9ef44bb4bc4f44d09799f93193fc079
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
Date:   Thu Mar 7 10:20:17 2024 -0600

    [troff]: Fix Savannah #65427 (check fp==nullptr).

    * src/roff/troff/node.cpp (ascii_output_file::outc)
      (ascii_output_file::outs, put_string, troff_output_file::put)
      (ascii_output_file::really_transparent_char)
      (ascii_output_file::really_print_line): Guard uses of standard C
      library `putc()` and `fputc()` functions with a null pointer check.
      They could fail if the output stream has been invalidated.  Problem
      present from groff's birth and apparently exposed by man-db man's use
      of AppArmor.  See
      <https://bugs.launchpad.net/ubuntu/+source/lintian/+bug/2055402> and
      follow-up discussion there.

    Fixes <https://savannah.gnu.org/bugs/?65427>.  Thanks to an anonymous
    submitter for the report.

    No apparent performance degradation, even _without_ optimization, on
    20 rebuilds of automake.pdf, contrib/mom/examples/*.pdf, and
    groff-man-pages.pdf.

    CFLAGS="-O0 -Og -ggdb"

    Before:
    + awk /Elapsed/ {time = $NF; sub("0:", "", time); print time}
    + datamash range 1 mean 1 sstdev 1
    3.35    11.0475 1.0103510333178

    After:
    + awk /Elapsed/ {time = $NF; sub("0:", "", time); print time}
    + datamash range 1 mean 1 sstdev 1
    2.49    10.81380952381  0.62027797148114


G. Branden Robinson <gbranden>
Group administrator
Thu 07 Mar 2024 04:27:19 PM UTC, comment #1: 

Claiming.  Bumping to Important severity.  SEGVs are bad, even if it's man-db man(1)'s use of AppArmor imposing them on it.

Will be checking for performance impact, since this hits (nearly) every byte produced in grout output.  (Also "groff -a" output, but that's not likely to be performance-sensitive.)

G. Branden Robinson <gbranden>
Group administrator
Wed 06 Mar 2024 10:34:05 PM UTC, original submission:  

Due to a problem in AppArmour policy in Ubuntu, the flush on output file may fail, see:

https://bugs.laun ... tian/+bug/2055402

While the root cause may be fixed by changing the security policy, the application should still not segfault in this case.

The reason for this segfault is that real_output_file::flush() will set fp=0 before calling fatal(). This will end up calling cleanup_and_exit() which calls troff_output_file::trailer via the_output->trailer().

troff_output_file::trailer() calls put() which ends up passing NULL pointer to putc(), which causes the segfault.

Anonymous

 

Attached Files

This item currently has no attached files.

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by gbranden (Posted a comment)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

    History

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-03-07 gbranden Summarytroff segfaults when output file flush fails [troff] SEGV after invalidation of output file stream
    2024-03-07 gbranden StatusIn Progress Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 1.24.0
    2024-03-07 gbranden Severity3 - Normal 4 - Important
        StatusNone In Progress
        Assigned toNone gbranden
    2024-03-07 barx Carbon-CopyRemoved 93119 -
    2024-03-07 barx Item GroupNone Crash/Unresponsive

    Back to the top

    Powered by Savane 3.16-598c.
    Corresponding source code