bugGNU troff - Bugs: bug #47164, [PATCH] multiple instances of...

 
 

bug #47164: [PATCH] multiple instances of mixing free(), delete and delete[] usage

Submitted by:  Balint Reczey <rbalint>
Submitted on:  Mon 15 Feb 2016 10:25:38 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: CrashStatus: Fixed
Privacy: PublicAssigned to: Werner LEMBERG <wl>
Open/Closed: ClosedPlanned Release: 1.22.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 04 Mar 2016 06:55:38 PM UTC, comment #4:

Good question, I don't know. I'm no longer the maintainer of groff since I lack time to take care of it. Please ask on the groff mailing list.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 04 Mar 2016 03:12:37 PM UTC, comment #3:

... near future ... :-)

Balint Reczey <rbalint>
Fri 04 Mar 2016 03:10:42 PM UTC, comment #2:

Is there any chance of having a new release with the fixes for crashes in in the new future?

Balint Reczey <rbalint>
Tue 16 Feb 2016 07:53:18 AM UTC, comment #1:

Patch applied, thanks!

Note that groff is very old code, using C++ only in a modest way (for example, completely avoiding templates).

Currently, there isn't a maintainer for groff who actively works on improvements, so don't expect much progress besides bug fixes.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 15 Feb 2016 10:25:38 PM UTC, original submission:

One example:
=================================================================
==514==ERROR: AddressSanitizer: alloc-dealloc-mismatch (operator new [] vs free) on 0x611000009b40
#0 0x7f28c02f5bfa in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x93bfa)
#1 0x40602c in imageList::createPage(int) /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1008
#2 0x4062c0 in imageList::createImage(imageItem*) /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1075
#3 0x40347a in imageList::createImages() /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1134
#4 0x40347a in generateImages /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1175
#5 0x40347a in main /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1859
#6 0x7f28bf64886f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2086f)
#7 0x403e18 in _start (/home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/src/preproc/html/pre-grohtml+0x403e18)

0x611000009b40 is located 0 bytes inside of 228-byte region [0x611000009b40,0x611000009c24)
allocated by thread T0 here:
#0 0x7f28c02f6d5a in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x94d5a)
#1 0x4196de in strsave(char const*) /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/libs/libgroff/strsave.cpp:26
#2 0x40473f in make_message(char const*, ...) /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:428
#3 0x406007 in imageList::createPage(int) /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1004
#4 0x4062c0 in imageList::createImage(imageItem*) /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1075
#5 0x40347a in imageList::createImages() /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1134
#6 0x40347a in generateImages /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1175
#7 0x40347a in main /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/preproc/html/pre-html.cpp:1859
#8 0x7f28bf64886f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2086f)

SUMMARY: AddressSanitizer: alloc-dealloc-mismatch ??:0 __interceptor_free
==514==HINT: if you don't care about these warnings you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0
==514==ABORTING

The attached patches fix enough places to have the Debian package build with -fsanitize=address and -fsanitize=undefined enabled, but it would probably be even better to use std:string everywhere it is possible instead.

Balint Reczey <rbalint>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #36351:  0004-Use-malloc-in-strsave-and-free-for-returned-pointers.patch added by rbalint (2KiB - text/x-diff - patches fixing many issues)
file #36352:  0005-Fix-many-malloc-new-vs.-free-delete-delete-mismatche.patch added by rbalint (17KiB - text/x-diff - patches fixing many issues)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by rbalint (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 16 Feb 2016 07:53:18 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>1.22.4
    Mon 15 Feb 2016 10:25:38 PM UTCrbalintAttached File-=>Added 0004-Use-malloc-in-strsave-and-free-for-returned-pointers.patch, #36351
      Attached File-=>Added 0005-Fix-many-malloc-new-vs.-free-delete-delete-mismatche.patch, #36352

    Back to the top


    Powered by Savane 3.1-cleanup1