bugGNU troff - Bugs: bug #56694, troff mixes malloc / delete[]


bug #56694: troff mixes malloc / delete[]

Submitted by:  None
Submitted on:  Mon 29 Jul 2019 09:17:29 PM UTC  
Category:  Core Severity:  3 - Normal
Item Group:  Crash/Not responding Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Mon 29 Jul 2019 09:17:29 PM UTC, original submission:  

I use Scudo [1] as the systemwide allocator on most of my systems. GNU troff is one of the very few binaries that fail with it, due to relying on undefined behavior with memory allocation.

Specifically, the search_path::open_file(..., char**) returns a path that is sometimes allocated with new[] but usually allocated with malloc (since that's how the "strsave" function is implemented -- it's basically an strdup). The returned paths are then deallocated using delete[], which is undefined behavior and only works with some lenient memory allocators.

Attached is a draft patch that solves the issue as far as I can tell with some basic testing, but I have no idea how common that pattern is in the codebase and I don't have a good way to test all of it. And it's not a beautiful patch either.

[1] https://llvm.org/docs/ScudoHardenedAllocator.html



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #47276:  free.diff added by None (2KiB - text/x-patch)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.




Follows 1 latest change.

Date Changed by Updated Field Previous Value => Replaced by
2019-07-29 None Attached File- => Added free.diff, #47276

Back to the top

Powered by Savane 3.5