bugGNU roff - Bugs: bug #47162, [PATCH] [grotty,libgroff,troff]...

 
 

bug #47162: [PATCH] [grotty,libgroff,troff] invalid memory access in small_temp_iterator::operator new

Submitter:  Balint Reczey <rbalint>
Submitted:  Mon 15 Feb 2016 10:03:14 PM UTC
   
 
Category:  General Severity:  3 - Normal
Item Group:  Crash/Unresponsive Status:  Fixed
Privacy:  Public Assigned to:  wl
Open/Closed:  Closed Planned Release:  1.22.4
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 15 Feb 2016 11:34:56 PM UTC, comment #1: 

Patch applied, thanks!

Werner LEMBERG <wl>
Group administrator
Mon 15 Feb 2016 10:03:14 PM UTC, original submission:  

...
No symbol table info available.
#3  0x00007fd6c6411653 in __ubsan_handle_dynamic_type_cache_miss () from /usr/lib/x86_64-linux-gnu/libubsan.so.0
No symbol table info available.
#4  0x000000000045da43 in small_temp_iterator::operator new (n=n@entry=64) at /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/roff/troff/input.cpp:3632
        i = <optimized out>
        p = <optimized out>
#5  0x000000000045dd9a in make_temp_iterator (s=0x8cb073 <buf+19> "0") at /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/roff/troff/input.cpp:3674
        n = <optimized out>
#6  0x000000000046290b in interpolate_number_reg (nm=..., inc=<optimized out>) at /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/roff/troff/input.cpp:4975
        r = 0x25160d0
#7  0x0000000000472413 in token::next (this=0x8c76c0 <tok>) at /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/roff/troff/input.cpp:2133
        inc = 0
        s = {static table = 0x2537f60, static table_used = 908, static table_size = 4001, static block = 0x2501d4a "", static block_size = 214, s = 0x25157d8 ".C"}
        n = 0x0
        cc = <optimized out>
        x = 2063780463
...

Many invalid memoory accesses were caught by ASAN & UBSAN while bootstrapping hardened1-linux-amd64 Debian port.

In the current bug the free_list handling broke.
One problem with the free_list implementation is the inaccurate calculation of memory needed for storing the free_list array because it does not consider the padding between array elements:
...
(small_temp_iterator *)new char[sizeof(small_temp_iterator)*BLOCK];
...
https://en.wikipedia.org/wiki/Data_structure_alignment
https://en.wikipedia.org/wiki/Stride_of_an_array

The proposed patch removes all free_list handling, because probably they are not providing significant speed gain with current C++ compilers anyway.

Balint Reczey <rbalint>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #36349:  0001-Get-rid-of-free_list-s.patch added by rbalint (9KiB - text/x-diff - patch fixing the issue)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gbranden (Updated the item)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by rbalint (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-05-02 gbranden CategoryNone General
        Summary[PATCH] invalid memory access in small_temp_iterator::operator new [PATCH] [grotty,libgroff,troff] invalid memory access in small_temp_iterator::operator new
    2016-02-15 wl Item GroupNone Crash/Unresponsive
        StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 1.22.4
    2016-02-15 rbalint Attached File- Added 0001-Get-rid-of-free_list-s.patch, #36349

    Back to the top

    Powered by Savane 3.13-0329.
    Corresponding source code