bugGNU troff - Bugs: bug #55331, ...


bug #55331: src/utils/hpftodit/hpftodit.cpp:577:Wmismatched-new-delete

Submitted by:  David Binderman <dcb314>
Submitted on:  Sun 30 Dec 2018 10:59:41 AM UTC  
Category:  None Severity:  4 - Important
Item Group:  Incorrect behaviour Status:  Confirmed
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  1.22.5

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Mon 31 Dec 2018 01:59:02 PM UTC, comment #1: 

Bug confirmed by code inspection.  Both lines quoted by David are in the function output_font_name(), and the code progresses linearily and unconditionally from the "new[]" to the "delete", without any branching in or out in between, so every invocation of the new[] is 100% certain to trigger the bug at run time.

According to Stroustrup, mismatches of this kind can trigger compiler-implementation-dependent undefined behaviour.  So this should be treated as a severe and potentially dangerous bug, similar to a buffer overflow or double free, with potential for incorrect and insecure behaviour and crashes.

So i'm setting the item group to "incorrect behaviour", the severity to "important", and the "planned release" to 1.22.5.

The obvious fix is

-  delete font_name;
+  delete[] font_name;

Unfortunately, i never used hpftodit(1) and don't even understand its purpose, so i cannot test and hence won't commit.  But if somebody else can test, you have my OK for that fix.

Ingo Schwarze <schwarze>
Project Member
Sun 30 Dec 2018 10:59:41 AM UTC, original submission:  

src/utils/hpftodit/hpftodit.cpp:577:3: warning: 'delete' applied to a pointer that was allocated with 'new[]'; did you mean 'delete[]'? [-Wmismatched-new-delete]

$ fgrep font_name src/utils/hpftodit/hpftodit.cpp
  char *font_name = new char[count];

  delete font_name;

David Binderman <dcb314>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by schwarze (Posted a comment)
  • -email is unavailable- added by dcb314 (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-12-31 schwarze Severity3 - Normal => 4 - Important
        Item GroupNone => Incorrect behaviour
        StatusNone => Confirmed
        Planned ReleaseNone => 1.22.5

    Back to the top

    Powered by Savane 3.5